Adobe ColdFusion EUVD-2026-100666

Exploitation requires the attacker to first authenticate as a low-privileged user on the ColdFusion server (CVSS PR:L), after which a crafted malicious input triggers the improper input validation flaw remotely over the network with no user interaction. The affected deployments are Adobe ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13); systems on patched releases per APSB26-144 are not affected. The principal limiting factor is the authentication requirement - an attacker needs valid credentials or an existing low-privileged session, so exposure is highest where ColdFusion login is reachable from untrusted networks or where weak/shared low-privilege accounts exist. The specific vulnerable endpoint or feature is not named in the available data.

This is a credible high-priority issue but short of maximum urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privileged authentication and no user interaction, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) and arbitrary code execution - consistent with the 8.8 score and the 'RCE' tag. However, key exploitation signals are MISSING from the input: no EPSS probability is provided, there is no CISA KEV listing, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The PR:L requirement is a meaningful mitigating factor - an attacker must first obtain valid low-privileged ColdFusion credentials or a foothold, meaning this is not a pre-auth internet-wide mass-exploitation candidate in the way a PR:N ColdFusion RCE would be. Adobe ColdFusion has a strong historical track record of in-the-wild exploitation once patches reveal the bug, so the practical risk of future weaponization is elevated despite the absence of current KEV/POC data. Treat as a priority patch for any internet-exposed or multi-user ColdFusion instance, while recognizing that the authentication prerequisite tempers the raw CVSS number.

An attacker who already holds low-privileged credentials on an internet-facing ColdFusion 2023 or 2025 server submits a crafted request to a vulnerable endpoint that improperly validates input, triggering arbitrary code execution in the context of the running ColdFusion user. No user interaction is required, so the attacker can script the request directly after authenticating. No public exploit code is identified at the time of analysis, but the low attack complexity makes exploit development straightforward once details are known.