Adobe ColdFusion EUVD-2026-100665

Exploitation requires an authenticated low-privileged account on the ColdFusion server (CVSS PR:L) and local/adjacent access to the application (AV:L), not remote unauthenticated reach. Adobe explicitly states the exploit 'depends on conditions beyond the attacker's control,' which the vector encodes as AC:H - meaning success hinges on a specific server state, timing, or configuration the attacker cannot reliably force. No user interaction is required (UI:N). Limiting factors for defenders: the need for valid low-privilege credentials, the high attack complexity, and the local vector together make reliable mass exploitation unlikely; affected deployments are specifically ColdFusion 2023 at or below 2023.0.25 and ColdFusion 2025 at or below 2025.0.13.

This is a genuine but conditionally-exploitable priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with the description: AV:L and AC:H reflect that the flaw requires local vector access and that, per Adobe, 'exploit depends on conditions beyond the attacker's control,' while PR:L reflects the stated low-privileged attacker and S:C reflects the noted scope change. Mitigating signals: exploitation is not trivially remote (AV:L) and is high-complexity (AC:H), so this is not a mass-scannable internet-facing RCE in the mold of prior ColdFusion deserialization bugs. Aggravating signals: full C:H/I:H/A:H impact with scope change and no user interaction, from only a low-privileged starting position, makes this a strong privilege-escalation / code-execution primitive on a historically heavily-targeted platform. No EPSS score, no CISA KEV listing, and no POC are present in the provided data, so there is no evidence of active exploitation at time of analysis. CONFLICT/CAVEAT: the input Tags label this 'Authentication Bypass, RCE,' but the CWE-863 (Incorrect Authorization) classification and the description both describe an authorization flaw requiring an already-authenticated low-privileged user - not a pre-auth bypass - so the 'Authentication Bypass' tag overstates the pre-conditions; verify against Adobe APSB26-144.

An attacker who already holds a low-privileged account on a ColdFusion 2023 (≤2023.0.25) or 2025 (≤2025.0.13) server abuses an improper authorization check to perform an action that should be restricted, achieving arbitrary code execution in the context of the current user. Because the CVSS vector specifies AC:H and Adobe notes the exploit 'depends on conditions beyond the attacker's control,' success is not guaranteed on every attempt and may require a specific server state or race. No public proof-of-concept is identified in the provided data.