Adobe ColdFusion EUVD-2026-100517

Exploitation requires an authenticated low-privileged account on the affected Adobe ColdFusion instance (PR:L) AND active user interaction - specifically a victim must open an attacker-supplied malicious file (UI:R), per the description. The access vector is local (AV:L), so the flaw is not reachable through a plain network request against an exposed ColdFusion server without a prior foothold. Affected deployments are ColdFusion 2023 at or below 2023.0.25 and ColdFusion 2025 at or below 2025.0.13; patched builds are not vulnerable. These limiting factors - local vector, required valid credentials, and mandatory victim file-open action - substantially constrain realistic exploitation versus a remote unauthenticated flaw, making it most relevant where an attacker already has a user-level presence.

This is a genuine high-severity issue but NOT a drop-everything emergency based on available signals. The CVSS 3.1 base score of 8.2 (High) is driven largely by the changed scope (S:C) and triple-H impact (C:H/I:H/A:H) rather than by easy reachability: the vector is AV:L (local), PR:L (requires an authenticated low-privileged user) and UI:R (a victim must open a malicious file). In practice this means an attacker cannot hit this remotely and unauthenticated against an exposed server - they need both a foothold and social-engineering of a victim. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public POC was supplied in the intelligence, so this is a vendor-reported (Adobe PSIRT) issue with no confirmed in-the-wild activity. The one notable tension: the input Tags label this 'Authentication Bypass' and 'RCE', and the root weakness is CWE-863 (Incorrect Authorization), yet the CVSS vector requires UI:R and PR:L - i.e. it is a privilege/authorization flaw reached via a malicious file opened by a user, not a classic unauthenticated remote bypass. Treat the 'Authentication Bypass' framing cautiously; the vector describes an authenticated, local, user-interaction-dependent path. Overall: a legitimate patch priority for ColdFusion operators, but behavior and KEV/EPSS signals point to it being a lower real-world exploitation risk than the 8.2 alone suggests.

A low-privileged but authenticated user on a system running Adobe ColdFusion is socially engineered into opening a malicious file; the incorrect authorization check is bypassed and attacker-controlled code executes in the context of the current user, with a scope change allowing impact beyond the initially vulnerable component. No public exploit code was identified at time of analysis, so weaponization would require original development. Because the vector is local (AV:L) and demands user interaction (UI:R), this is more plausible as part of a targeted, multi-stage intrusion than mass opportunistic exploitation.