EUVD-2026-100507
GHSA-9p82-5qfv-qq3m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege ColdFusion access
-
DeliverySubmit crafted SSRF request
-
ExploitServer fetches attacker-chosen internal URL
-
ExecutionReach internal resources across trust boundary
-
ImpactEscalate access to internal systems
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated attacker holding HIGH privileges on ColdFusion (PR:H) - effectively an administrative or elevated operator account - so it is not exploitable against default unauthenticated configurations. No user interaction is needed (UI:N). The primary limiting factor is the high-privilege precondition: the attacker must already be authenticated with elevated rights before the network-reachable SSRF can be triggered. Realistic risk is therefore concentrated on internet-exposed ColdFusion administrative interfaces and insider/post-compromise scenarios. Affected deployments are ColdFusion 2025 ≤2025.0.13 and ColdFusion 2023 ≤2023.0.25. |
| Impact | This is a solid-priority-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N, 7.6 High) shows network reach and low attack complexity with no user interaction, but critically requires high privileges (PR:H) - the attacker must already hold an administrative/elevated ColdFusion account. The scope change (S:C) is what inflates the score: the SSRF lets an already-privileged actor pivot to internal resources beyond ColdFusion's own security authority (C:H). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no signal of active or probable near-term exploitation. The available signals are internally consistent (network SSRF plus a high-privilege precondition) rather than conflicting. Net: this is a meaningful privilege-escalation/pivot risk for internet-exposed ColdFusion admin surfaces, but the PR:H gate makes it an insider or post-compromise escalation threat rather than a mass-exploitable unauthenticated bug. EPSS and KEV data are absent and should be checked before final prioritization. |
| Exploit ScenarioDerived | An attacker who already holds high-privilege ColdFusion access (e.g., a compromised administrator credential or a malicious privileged operator) submits a crafted request that causes the ColdFusion server to issue attacker-controlled requests to internal network resources. Because scope is changed, the server reaches systems the attacker could not directly contact, exposing internal services and enabling privilege escalation. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a high-privileged ColdFusion account force the server to issue requests to internal or otherwise restricted resources, resulting in privilege escalation and unauthorized access to internal services. The vulnerability is network-reachable (AV:N), needs no user interaction (UI:N), but is gated by the high-privilege precondition (PR:H), so it is not exploitable against default unauthenticated configurations - the practical risk is concentrated on internet-exposed ColdFusion administrative interfaces and insider or post-compromise scenarios. The CVSS vector changes scope (S:C), meaning the attacker can leverage the vulnerable ColdFusion component to affect resources outside its own security authority, and no public exploit code has been identified at time of analysis. This is a solid-priority-but-not-emergency issue rather than an emergency, driven mainly by the privileged access required to trigger it.
RemediationAI
Apply the ColdFusion update published in Adobe security bulletin APSB26-144 (https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html), which supersedes the vulnerable branches - ColdFusion 2025 up to and including 2025.0.13 and ColdFusion 2023 up to and including 2023.0.25; the bulletin lists the exact fixed build for each branch, and that vendor-supplied build number should be used rather than any inferred version. Patch status is therefore patch available per vendor advisory, and no public exploit code has been identified for this CVE. Because the flaw requires an already-authenticated high-privileged account (PR:H) and an outbound request originating from the ColdFusion server, compensating controls should focus on reducing that attack surface while patching is staged: remove direct internet exposure of the ColdFusion Administrator and other elevated management endpoints, placing them behind VPN or an IP allow-list (trade-off: remote administration and automation must be routed through the VPN or bastion); apply egress filtering on the ColdFusion host so it can only reach an explicit allow-list of required external services (trade-off: legitimate CFHTTP, web service, and integration calls to unlisted hosts will fail until added); explicitly block requests to link-local and cloud metadata addresses such as 169.254.169.254 and to internal RFC1918 ranges from the ColdFusion process (trade-off: internal service integrations using private addressing must be enumerated and permitted deliberately); enforce least privilege and just-in-time elevation for ColdFusion administrative accounts and audit their use (trade-off: adds friction to routine administration); and enable verbose outbound-request logging to alert on anomalous SSRF-style patterns. Prioritize internet-facing administrative interfaces and multi-tenant or insider-exposed deployments, since those are where the high-privilege precondition is most likely to be met.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-918 server-side request forgery in Adobe ColdFusion, a Java-based application server platform. In SSRF, the vulnerable component accepts a user-influenced destination (URL, host, or resource identifier) and performs the outbound request with its own network identity, so the adversary never needs direct network reachability to the target - ColdFusion becomes the proxy. Because the vulnerable code runs at an elevated privilege level within the product (PR:H in the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N vector), the payload is delivered by an authenticated high-privileged operator or administrative account rather than an anonymous user; the Adobe advisory does not disclose the specific endpoint or parameter involved. The scope-change (S:C) metric is the key interpretive signal: successful exploitation moves the security impact from the ColdFusion component to other components - internal web services, administrative APIs, cloud instance metadata endpoints, or file/network resources the ColdFusion host can reach but the attacker cannot. Impact is rated high on confidentiality (C:H) and low on integrity (A:N, I:L), consistent with an SSRF whose primary payoff is reading or reaching protected internal resources rather than altering data. The tag set (SSRF, Privilege Escalation) matches Adobe's own characterization, and the CWE-918 classification aligns with the advisory language.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Network-reachable SSRF needing an existing high-privilege account (PR:H, AC:L, UI:N); scope changes as the server reaches internal systems (S:C, C:H), with only limited integrity and no availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) carry a server-side request forgery flaw that would let an authenticated holder of a high-privileged ColdFusion account redirect the application server into internal or otherwise restricted network resources, crossing a security boundary the platform was meant to enforce. Because no vendor patch is available and no public exploit has been identified at time of analysis, the practical exposure is concentrated in organizations that publish ColdFusion administrative interfaces to the internet or grant broad admin rights to staff, where a single compromised or misused credential becomes a stepping stone to internal services. Leadership should care less about broad external attack volume and more about the insider and post-compromise path: any team operating an internet-facing ColdFusion administration console should treat focused hardening and monitoring as a near-term priority.
No vendor-released patch was identified at time of analysis; interim mitigations: remove ColdFusion administrative interfaces from direct internet exposure (VPN or IP allowlisting only), enforce MFA and least privilege for all ColdFusion admin accounts, apply the vendor's ColdFusion lockdown/secure profile guidance, restrict server egress with deny-by-default firewall rules blocking outbound access to internal RFC1918 and management networks, segment the ColdFusion host into a restricted zone, and monitor ColdFusion logs for anomalous server-initiated requests to internal resources. Note this vulnerability requires an authenticated high-privileged ColdFusion account (CVSS PR:H).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB