Adobe ColdFusion EUVD-2026-100513

Exploitation requires a network-reachable ColdFusion 2023 (≤2023.0.25) or ColdFusion 2025 (≤2025.0.13) instance; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against such an exposed instance. The practical impact depends on the ColdFusion server having network access to sensitive internal resources (e.g., cloud metadata services, internal APIs, or privileged back-end endpoints) that the SSRF can be pointed at - the scope change (S:C) reflects this crossing into those back-end systems. Realistic risk is limited where ColdFusion is not internet-exposed, where egress/SSRF filtering restricts outbound requests, and where no valuable internal endpoints are reachable; the description provides no specific feature toggle or non-default configuration prerequisite, implying default-configuration exposure of the affected versions.

This is a genuine high-priority issue, though not a top-tier emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6 HIGH) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction and a changed scope - meaning the SSRF (CWE-918) crosses a trust boundary from the vulnerable ColdFusion server to back-end/internal resources. The confidentiality-only high impact (C:H, I:N, A:N) aligns with classic SSRF used to read internal metadata/services, which the description characterizes as enabling privilege escalation. No EPSS probability is supplied, there is no CISA KEV listing, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The absence of KEV/POC/EPSS is notable but is not evidence of safety: Adobe ColdFusion has a strong historical pattern of rapid post-disclosure exploitation, so the lack of exploitation data should be treated as 'not yet observed/not provided' rather than 'low real risk.' The description's claim of 'privilege escalation' is slightly in tension with a pure SSRF (I:N, A:N) CVSS profile - the escalation is most likely indirect (SSRF leveraged to reach privileged internal endpoints), and this nuance should be verified against Adobe advisory APSB26-144.

An unauthenticated remote attacker sends a crafted request to an internet-facing ColdFusion 2023 or 2025 instance that coerces the server into making attacker-controlled outbound requests. Because scope is changed, the attacker uses this to reach internal-only services or metadata endpoints the ColdFusion host can access, harvesting credentials or tokens that enable privilege escalation. No public exploit is identified at time of analysis, and no user interaction is required.