EUVD-2026-35829
GHSA-jpc9-55w6-65ch
Severity by source
AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Adjacent vector and high privileges match an admin-only interface; scope change reflects code execution escaping the ColdFusion boundary to underlying system resources.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
11DescriptionNVD
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe ColdFusion 2023.19, 2025.8, and earlier stems from improper input validation (CWE-20), allowing a high-privileged attacker on an adjacent network to execute code in the context of the current user with a scope change that can impact resources outside the vulnerable component. No user interaction is required, but exploitation is constrained by the adjacent-network attack vector and high-privilege prerequisite, placing real-world risk well below what the 8.4 CVSS score might initially suggest. No public exploit code or active exploitation has been identified at time of analysis, consistent with an EPSS of 0.04% (14th percentile) and SSVC exploitation status of 'none'.
Technical ContextAI
Adobe ColdFusion is an enterprise web application development and runtime platform widely used for server-side scripting and database-driven web applications. The vulnerability is rooted in CWE-20 (Improper Input Validation), meaning user-supplied or network-supplied input reaches a sensitive code path without adequate sanitization or type checking, enabling an attacker to shape execution flow toward arbitrary code execution. The CVSS scope-change indicator (S:C) reveals that successful exploitation can escape the ColdFusion application boundary and affect underlying system resources or adjacent components beyond the initially vulnerable service. CPE data confirms affected components are cpe:2.3:a:adobe:coldfusion:2023 through cpe:2.3:a:adobe:coldfusion:2023:update17, plus ColdFusion 2025 up to update 2025.8, as reported by Adobe PSIRT (psirt@adobe.com) via advisory APSB26-64.
RemediationAI
The primary fix is to upgrade Adobe ColdFusion to a version beyond the affected ranges: for the 2023 release line, apply an update higher than Update 17 (2023.19); for the 2025 release line, apply a version higher than Update 8 (2025.8). The authoritative vendor advisory is Adobe APSB26-64, available at https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html - consult it for the exact patched release numbers, as independently confirmed patch version numbers are not available in the current data set. If immediate patching is not possible, compensating controls should focus on the adjacent-network attack vector and high-privilege prerequisite: restrict network access to ColdFusion's administrative interface (ColdFusion Administrator) to trusted management VLANs only, enforce multi-factor authentication on administrative accounts to raise the bar beyond a stolen credential, and audit all accounts with ColdFusion administrative privileges, removing any unnecessary. Blocking access at the network perimeter does not address insider-threat scenarios, so privilege reduction is the more impactful control. Monitor ColdFusion logs for unusual code execution or configuration changes as a detection measure.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets remote attackers (PR:N) read arbitrary
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today