Adobe ColdFusion EUVD-2026-100509

Per the vendor CVSS metrics (AV:L, PR:L, UI:N), exploitation requires the attacker to already hold low-privileged access to the ColdFusion instance and to be able to reach it via a local vector; no user interaction is needed. The core precondition is running an affected build - ColdFusion 2023 at or below 2023.0.25, or ColdFusion 2025 at or below 2025.0.13. The limiting factors are the need for some pre-existing (low-level) authentication/privilege and the local attack vector, which reduce realistic exposure compared to a remote-unauthenticated flaw; however, the 'Authentication Bypass' tag suggests Adobe may consider the authorization barrier weaker than PR:L implies, so defenders should confirm whether any authenticated session is truly required by consulting APSB26-144.

This is a credible priority for any organization running an affected ColdFusion release, but the signals are mixed and warrant scrutiny. The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) describes a LOW-privilege, no-interaction flaw that yields full code execution with a changed scope - a severe combination. However, there is a notable internal conflict: the CVSS vector specifies AV:L (local attack vector) and PR:L (an authenticated, low-privileged actor), yet the Tags label this an 'Authentication Bypass' and 'RCE', which would normally imply remote, pre-authentication reach (AV:N/PR:N). These cannot both be literally true - verify the true attack surface with Adobe APSB26-144 before assuming either remote-unauthenticated or purely local-authenticated exploitation. On the exploitation-likelihood side, there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is currently no public exploit identified at time of analysis and no evidence of active exploitation. Net: a high technical-impact bug (CWE-863 incorrect authorization leading to code execution) that should be patched promptly given ColdFusion's history of being targeted, but the absence of KEV/EPSS/POC signals means this is not (yet) a confirmed mass-exploitation event. Treat as high-priority remediation, not emergency in-the-wild response.

A low-privileged attacker who already has limited access to a ColdFusion 2023 (≤2023.0.25) or 2025 (≤2025.0.13) instance abuses the incorrect-authorization flaw to perform actions beyond their privilege level and achieve arbitrary code execution in the context of the ColdFusion user. Because scope is changed, the resulting code execution can affect resources beyond the originally authorized security boundary. No public exploit code was identified at time of analysis, and the attack requires no user interaction.