EUVD-2026-22736Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
4DescriptionCVE.org
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
AnalysisAI
ColdFusion versions 2023.18, 2025.6 and earlier are vulnerable to uncontrolled resource consumption that allows high-privileged attackers to trigger denial-of-service by exhausting system resources without user interaction. The CVSS score of 2.4 reflects low severity due to the high-privilege requirement (PR:H), though the attack vector is adjacent network access and does not require authentication once the attacker has elevated privileges.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Risk Assessment | Despite the CVSS score of 2.4, real-world risk is constrained by the PR:H requirement, which limits the attacker pool to administrators or system operators with high-privilege credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A disgruntled administrator or an attacker who has compromised a ColdFusion admin account uses the high-privileged access to trigger a resource exhaustion condition-for example, by initiating a long-running operation or crafted request that consumes excessive CPU or memory. This gradually degrades application responsiveness for all users without triggering alarms tied to explicit errors or security events. … |
| Remediation | Apply the security update referenced in Adobe Security Advisory APSB26-38 (https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today