What is the CVSS score of EUVD-2026-35828?

EUVD-2026-35828 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Adobe ColdFusion are affected by EUVD-2026-35828?

Adobe ColdFusion versions 2023.19 and 2025.8 and earlier contain an authentication bypass vulnerability (CVSS 8.1) allowing attackers to gain unauthorized read/write access to protected systems and…

How to fix or mitigate EUVD-2026-35828?

Within 24 hours: Identify and inventory all systems running Adobe ColdFusion 2023.19, 2025.8, and earlier versions; enable detailed logging of authentication events and resource access; restrict network access to ColdFusion instances to trusted internal networks only. Within 7 days: Deploy Web Application Firewall (WAF) rules configured to detect and block authentication bypass attempts; implement reverse proxy or load balancer with additional authentication enforcement in front of ColdFusion; enable multi-factor authentication for all administrative access. Within 30 days: Monitor Adobe's official security page (adobe.com/security) daily for patch release; prepare upgrade path and maintenance window to deploy patched ColdFusion versions when available; if no patch is released within 30 days, evaluate migration to alternative platforms.

Adobe ColdFusion EUVD-2026-35828

| CVE-2026-47930 HIGH

Improper Input Validation (CWE-20)

2026-06-09 psirt@adobe.com

GHSA-w3fv-q97h-6qqh

Authentication Bypass Coldfusion

8.1

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:31 vuln.today

DescriptionCVE.org

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

AnalysisAI

Security feature bypass in Adobe ColdFusion 2023.19, 2025.8 and earlier allows a low-privileged remote attacker to circumvent authentication controls and gain unauthorized read and write access to protected resources. The flaw stems from improper input validation (CWE-20) and is network-exploitable without user interaction, earning a CVSS 8.1 rating. No public exploit identified at time of analysis, but ColdFusion has a strong history of post-disclosure exploitation, making rapid patching essential.

Technical ContextAI

Adobe ColdFusion is a commercial rapid web-application development platform built on a JVM-based CFML engine, widely deployed in enterprise and government environments to serve dynamic web content and APIs. The root cause is classified as CWE-20 (Improper Input Validation), meaning the affected component fails to properly sanitize or validate input before using it in a security-sensitive decision - in this case, an authentication or authorization check. The vendor tag 'Authentication Bypass' indicates the malformed input lets an attacker traverse logic that should enforce access boundaries, leading to direct read and write operations against resources the attacker's account should not reach. Affected versions span both the 2023 and 2025 release trains (2023.19 and 2025.8 and earlier).

RemediationAI

Apply the patched ColdFusion updates referenced in Adobe Security Bulletin APSB26-64 (https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html); the exact fixed update numbers were not included in the supplied data, so administrators must consult that advisory for the precise versions for the 2023 and 2025 trains. Until patching is complete, apply Adobe's ColdFusion lockdown guide, restrict network access to the ColdFusion Administrator and any developer endpoints (/CFIDE/administrator, /CFIDE/adminapi, /CFIDE/componentutils) to trusted management networks via firewall or reverse-proxy ACLs, and audit all low-privilege ColdFusion accounts for unexpected use, rotating any credentials that may have been exposed. Note that restricting /CFIDE paths can break legitimate development workflows and some component introspection features, so coordinate the change with application owners.