Adobe ColdFusion EUVD-2026-100674

The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the explicit statement that exploitation does not require user interaction indicate no special conditions - remote unauthenticated exploitation against network-reachable deployments of Adobe ColdFusion (2023 ≤2023.0.25 and 2025 ≤2025.0.13). The scope change (S:C) means impact reaches internal systems beyond the ColdFusion process boundary, so the practical severity depends on what internal services the server can reach (e.g., cloud metadata endpoints, internal APIs); segmentation and egress filtering that restrict the server's outbound/internal reachability are the primary limiting factors. The description does not name a specific feature or non-default setting that must be enabled, so exploitation appears to apply to standard configurations of the affected versions; limiting factors are therefore version (patched builds above the listed ranges are not affected) and network exposure rather than configuration or authentication.

This is a credible priority flaw, though several real-risk signals are missing from the provided data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes a network-reachable, low-complexity, unauthenticated SSRF with a changed scope and high confidentiality impact - the classic high-severity profile for an internet-facing application server. No EPSS score, no CISA KEV listing, and no POC indicator were supplied, so exploitation probability and in-the-wild activity cannot be quantified from this input: no public exploit identified at time of analysis. No SSVC decision data was provided either. The key tension to flag: the description frames the outcome as 'privilege escalation,' yet the CVSS vector assigns C:H with I:N and A:N, which is consistent with SSRF-driven information disclosure (e.g., reading internal metadata or credentials) rather than direct rights modification - verify with Adobe APSB26-144 whether 'privilege escalation' is a downstream consequence of the SSRF rather than a separate integrity impact. Context weighs toward elevated attention: Adobe ColdFusion has a strong history of rapid exploitation of unauthenticated server-side bugs, so the absence of a KEV entry likely reflects timing/recency rather than low threat. Confirmed signals (vendor-sourced CVSS, affected versions, patch) justify prompt patching; unconfirmed signals (EPSS/KEV/POC) mean the 'active exploitation' question remains open and should be monitored.

A remote, unauthenticated attacker sends a crafted request to an internet-facing ColdFusion server, coercing it to issue server-side requests to internal-only endpoints (such as cloud instance metadata services or internal APIs) and harvesting sensitive responses that enable privilege escalation. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with scope changed, no credentials or user interaction are needed and the impact crosses into otherwise-unreachable internal systems. No public exploit identified at time of analysis, so this scenario is inferred from the SSRF (CWE-918) classification and CVSS metrics.