Adobe ColdFusion EUVD-2026-100512

Exploitation requires the attacker to already hold a low-privileged authenticated session on the ColdFusion instance (PR:L), so fully anonymous abuse is not indicated by the CVSS vector - this authentication requirement is the primary limiting factor. Affected deployments are specifically Adobe ColdFusion 2023 at or below update 2023.0.25 and ColdFusion 2025 at or below update 2025.0.13; patched/later updates are not vulnerable. No user interaction and no special non-default configuration is called out in the description, meaning default installations within the affected version range are exposed once an attacker obtains any low-privilege foothold. The description does not name a specific optional feature or setting as a precondition, so the gating factor is the version and possession of low-privilege credentials rather than a particular configuration mode.

This is a genuinely high-priority issue, not merely a high-CVSS paper tiger. The Adobe-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 9.6) describes network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with a scope change amplifying impact beyond the vulnerable component - a profile consistent with ColdFusion's history as a heavily targeted enterprise platform. The CWE-863 (Incorrect Authorization) root cause and 'security feature bypass / unauthorized write access' description align well with the vector. That said, key real-world exploitation signals are MISSING from the input: there is no EPSS probability, no CISA KEV listing, no SSVC decision data, and no POC indicator provided, so active-exploitation likelihood cannot be quantified here. One internal tension to verify: the description emphasizes gaining 'unauthorized write access' (an integrity outcome) yet Adobe rates confidentiality C:H - the basis for high confidentiality impact is not explicit in the description and should be confirmed with the vendor advisory (APSB26-144). Given ColdFusion's strong track record of post-disclosure exploitation, defenders should treat this as patch-now despite the absence of explicit KEV/EPSS data.

A remote attacker holding low-privileged but valid access to a ColdFusion 2023 (≤2023.0.25) or 2025 (≤2025.0.13) instance sends crafted requests that exploit the incorrect-authorization flaw, bypassing a security feature to obtain write access they should not have. Because the CVSS scope is changed, the write primitive can affect resources beyond the originally authorized component, potentially enabling further compromise. No public exploit identified at time of analysis, and no user interaction is required.