Adobe ColdFusion EUVD-2026-100669

No special conditions - remote unauthenticated exploitation against network-reachable Adobe ColdFusion (2025 ≤2025.0.13, 2023 ≤2023.0.25) per the AV:N/AC:L/PR:N/UI:N vector; no user interaction and no authentication are required. The practical limiting factors are: the ColdFusion instance must be reachable by the attacker (typically internet-exposed or reachable within the attack surface), and real-world impact depends on the presence of valuable internal services/endpoints the SSRF can reach (e.g., cloud metadata, internal admin APIs, credential stores) to realize the scope-changed privilege escalation. Organizations running patched builds above the listed versions are not affected.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes remote, network-reachable exploitation with low attack complexity, no privileges, and no user interaction, plus a scope change - the maximum-severity profile. CWE-918 (SSRF) leading to stated privilege escalation and a changed scope means the attacker can pivot from the ColdFusion server to reach and affect protected internal systems/components beyond the vulnerable one. Several key real-world signals are MISSING from the input: no EPSS probability is provided, there is no CISA KEV entry supplied, and no POC/exploit-code indicator is present - so exploitation status is 'no public exploit identified at time of analysis' and cannot be upgraded. Caveat worth noting: Adobe ColdFusion has a strong historical pattern of pre-auth flaws being rapidly weaponized and added to KEV after disclosure, so absence of KEV/EPSS here likely reflects the recency of this Adobe PSIRT advisory rather than low real risk - treat the 10.0 as credible and patch urgently. The CVSS vector and description are internally consistent (network SSRF, no auth), so there is no conflicting-signal problem to flag.

A remote, unauthenticated attacker sends a crafted request to an internet-reachable ColdFusion server that causes the server to issue attacker-controlled outbound requests (SSRF), reaching internal metadata/credential endpoints or trusted internal services the attacker could not otherwise contact. Because scope is changed, the attacker leverages the server's trusted position to escalate privileges and compromise confidentiality, integrity, and availability of internal resources. No public exploit is identified in the provided data, and the AV:N/AC:L/PR:N/UI:N vector means no special access or victim interaction is needed.