What is the CVSS score of EUVD-2026-35830?

EUVD-2026-35830 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe ColdFusion are affected by EUVD-2026-35830?

Adobe ColdFusion versions 2023.19, 2025.8, and all earlier updates contain a critical remote code execution vulnerability (CVSS 9.6) exploitable by unauthenticated attackers on adjacent networks…

How to fix or mitigate EUVD-2026-35830?

Within 24 hours: Inventory all ColdFusion deployments across versions 2023.19, 2025.8, and earlier; assess network exposure and implement emergency network segmentation to restrict adjacent-network access to vulnerable instances. Within 7 days: Deploy WAF rules to filter malicious payloads, disable unnecessary ColdFusion services, restrict administrative interfaces via network policy, and establish enhanced monitoring for exploitation attempts targeting input validation. Within 30 days: Monitor Adobe security advisories continuously for patch availability and prepare documented rapid-deployment procedures; maintain network isolation and monitoring controls as interim protection until patching is feasible.

Adobe ColdFusion EUVD-2026-35830

| CVE-2026-47928 CRITICAL

Improper Input Validation (CWE-20)

2026-06-09 psirt@adobe.com

GHSA-xq2f-wvpp-9qrx

RCE Coldfusion

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Vendor-assigned adjacent vector kept (AV:A) with unauthenticated, no-interaction, easy-complexity access and total C/I/A plus scope change; AV:A should be re-verified since ColdFusion RCEs are often network-reachable.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 17:45 vuln.today

v4 (cvss_changed)

CVSS changed

Aug 05, 2026 - 17:37 NVD

10.0 (CRITICAL) 9.6 (CRITICAL)

Analysis Updated

Jun 15, 2026 - 15:31 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 15, 2026 - 15:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 15, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jun 15, 2026 - 15:22 NVD

9.6 (CRITICAL) 10.0 (CRITICAL)

Analysis Generated

Jun 09, 2026 - 21:30 vuln.today

DescriptionNVD

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion (2023.19, 2025.8 and all earlier updates) lets an unauthenticated attacker on an adjacent network run code in the context of the current ColdFusion process user without any user interaction. The flaw stems from improper input validation (CWE-20) and carries a scope change, meaning impact extends beyond the vulnerable component. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile), but the CVSS base score of 9.6 reflects total technical impact if reached.

Technical ContextAI

ColdFusion is Adobe's commercial rapid web-application development platform and application server, running CFML on top of a Java/JEE stack and typically deployed behind or alongside a web server to serve dynamic web applications. The root cause is CWE-20 (Improper Input Validation): the affected code paths accept attacker-controlled input without adequately constraining its type, length, format, or range, allowing that input to influence execution flow and ultimately reach a code-execution primitive. CPE data confirms the vulnerable train is cpe:2.3:a:adobe:coldfusion:2023 across the base release through update17 (and the EUVD range extends to 2025.8), indicating the weakness spans the entire 2023 update line plus the 2025 line rather than a single point release.

RemediationAI

Apply the fixed ColdFusion updates published in Adobe Security Bulletin APSB26-64 (https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html) - Patch available per vendor advisory; the exact fixed build numbers succeeding 2023.19 and 2025.8 are not stated in the available input, so confirm the precise target version directly from APSB26-64 before deploying. Until patched, reduce exposure by leveraging the adjacent-network (AV:A) constraint: restrict network reach to the ColdFusion server with segmentation and host/network ACLs so only trusted management hosts and the fronting web tier can reach its ports, and remove any direct exposure of the ColdFusion service and admin endpoints from broad VLANs or the Internet (side effect: legitimate cross-segment integrations may break and need explicit allow-listing). Additionally run ColdFusion under a least-privilege service account rather than an administrative/root account so 'context of the current user' code execution yields minimal privilege, and enable ColdFusion's lockdown/secure-profile guidance; these are compensating controls only and are not a substitute for the vendor patch.