Adobe ColdFusion EUVD-2026-100671

Requires the attacker to already possess a low-privileged authenticated ColdFusion account or session (PR:L) on an affected instance - ColdFusion 2023 at or below 2023.0.25, or ColdFusion 2025 at or below 2025.0.13. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The CVSS vector specifies a local vector (AV:L), which would limit exploitation to attackers with local/console or session-level access rather than purely remote internet attackers; however, this constraint conflicts with the 'RCE'/'Authentication Bypass' tags and should be confirmed against Adobe APSB26-144, because if the endpoint is in fact network-reachable the practical exposure is substantially higher. No non-default feature or configuration prerequisite is stated in the description.

Vendor-assigned CVSS 3.1 is 8.8 (High) via CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a local vector, low attack complexity, low privilege requirement, no user interaction, a changed scope, and total compromise of confidentiality, integrity and availability. There is a notable internal tension in the data: the CVSS vector specifies AV:L (local), yet the tags label this 'Authentication Bypass, RCE' and the CWE is CWE-863 (Incorrect Authorization) - RCE/auth-bypass in a web application server like ColdFusion is typically network-reachable, so the AV:L rating should be verified against the Adobe APSB26-144 advisory before deprioritizing based on 'local only.' No EPSS score was provided, so real-world exploitation probability cannot be quantified. This CVE is NOT in CISA KEV and no public exploit code was indicated, so exploitation status is 'no public exploit identified at time of analysis' - this is a patch-priority item based on severity and the low barrier (only a low-privileged account needed), not a confirmed active-exploitation emergency. Given ColdFusion's history as a frequent attacker target, the combination of PR:L + scope change + full RCE impact makes this a genuine priority for any organization running the affected versions, while acknowledging the absence of exploitation telemetry.

An attacker who already holds a low-privileged ColdFusion account (per PR:L) abuses the incorrect authorization flaw to bypass access controls and execute arbitrary code in the context of the current user, with the changed scope allowing impact beyond the initially vulnerable component. No user interaction is required (UI:N), lowering the operational bar. No public proof-of-concept was identified in the provided data, so exploitation currently requires custom development against the patched behavior.