Adobe ColdFusion EUVD-2026-100508

Exploitation requires the attacker to (1) have network adjacency to ColdFusion's administrative component, which per Adobe is restricted to an administrative network zone by default (AV:A), and (2) hold high privileges on the system (PR:H), meaning the attacker must already be an authenticated administrative/high-privilege user. No user interaction is required (UI:N). The limiting factors that reduce realistic risk are significant: this is not remotely reachable from an untrusted network, the default administrative-zone isolation blocks general network exposure, and valid high-privilege credentials are a prerequisite. Affected deployments are ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13).

This is a high-severity but access-gated issue rather than a drop-everything emergency. The CVSS 3.1 base score of 8.4 is inflated primarily by the changed scope (S:C) and triple-H impact (C:H/I:H/A:H from arbitrary code execution), but the access requirements meaningfully constrain real-world exploitability: the vector is Adjacent (AV:A), not Network, and privileges are High (PR:H). Adobe's own description reinforces this - 'the vulnerable component is restricted to an administrative network zone by default,' which aligns with AV:A and means an attacker must already be positioned inside a trusted administrative segment AND hold high privileges. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit was identified at time of analysis, so there is no signal of active or imminent exploitation. The combination of 'requires high privileges' plus 'requires adjacency to an admin-only zone' places this below internet-facing unauthenticated RCEs in priority; it is most relevant as a privilege/scope-escalation path for an attacker who has already gained an administrative foothold. No signals conflict here, but note the absence of EPSS/KEV/POC data means exploitation likelihood is unquantified rather than confirmed low.

An attacker who has already obtained high-privilege access within an organization's administrative network zone sends crafted, improperly validated input to the exposed ColdFusion administrative component. Because input validation is insufficient, this triggers arbitrary code execution in the context of the current user, and the changed scope allows impact to extend beyond the vulnerable component itself. No public exploit code was identified at time of analysis, and exploitation requires no user interaction (UI:N).