Adobe ColdFusion EUVD-2026-100516

Exploitation requires network access to an Adobe ColdFusion instance (2023 up to 2023.0.25, or 2025 up to 2025.0.13) and a low-privileged authenticated foothold on the application (PR:L), after which a crafted request triggers code injection with no user interaction (UI:N) and no stated non-default configuration requirement. The primary limiting factor is the need for some authenticated/low-privilege access rather than fully anonymous reach; versions at or below the patched releases addressed in Adobe APSB26-144 are affected, and updating to the fixed version removes exposure. The scope change (S:C) means successful exploitation can affect resources beyond the vulnerable component's security authority.

This is a genuine high-priority vulnerability, not a high-CVSS/low-real-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity code-injection flaw (CWE-94) requiring only low privileges and no user interaction, with a changed scope and full H/H/H impact, which drives the 9.9 base score - consistent with arbitrary code execution. The signals mostly align: remote vector, trivial complexity, and only a low-privilege foothold needed make this attractive for weaponization, and Adobe ColdFusion has a long history of post-patch mass exploitation. However, several key signals are MISSING from the provided data: no EPSS probability is supplied, there is no CISA KEV listing in the input, and no POC indicator is present. Per precision rules this is therefore 'no public exploit identified at time of analysis.' The one potential tension is PR:L: the description calls the attacker 'low-privileged,' confirming some authentication/foothold is required, which modestly lowers real-world risk versus a fully unauthenticated RCE - but given how often ColdFusion credentials or low-priv access are obtainable, the mitigating effect is limited. Overall: patch urgently; absence of EPSS/KEV data reflects missing inputs, not confirmed low risk.

A low-privileged attacker with access to a ColdFusion application endpoint sends a crafted request that injects attacker-controlled code (CWE-94), which the server evaluates, yielding arbitrary code execution in the context of the current user and, due to the changed scope, impact beyond the initially vulnerable component. No user interaction is required, so exploitation can be fully attacker-driven against a reachable instance. No public proof-of-concept was identified in the provided data at time of analysis.