EUVD-2026-40347
GHSA-xp9f-h8r8-p4j7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Network-delivered malicious file with no auth (PR:N) but mandatory victim interaction (UI:R); script executes across the user's session boundary (S:C) impacting confidentiality and integrity, with no availability effect (A:N).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and earlier stems from improper input validation (CWE-20) that lets an attacker craft a malicious file which, when opened by a victim, executes code in the context of the current user and can inject scripts to hijack the victim's account or session. The CVSS 3.1 base score is 9.3 (Critical) with a changed scope, reflecting cross-boundary impact once the victim is lured into interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a malicious, attacker-crafted file that is processed by ColdFusion (UI:R in the vector) - this user-interaction step is the primary limiting factor and means there is no remote, hands-off exploitation despite AV:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are partly mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious file designed to abuse ColdFusion's improper input validation and delivers it to a ColdFusion user via email, a shared link, or an upload workflow; when the victim opens the file, attacker-controlled script executes in the victim's context, allowing session/account takeover or elevated access. No public exploit code was identified at time of analysis, so an attacker would need to develop the payload independently; the low attack complexity (AC:L) means that once the mechanism is understood, reliable exploitation is straightforward provided the victim interacts. |
| Remediation | Patch available per vendor advisory - apply the updates published in Adobe Security Bulletin APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html) for your release train (the 2025.x line beyond 2025.9 and the 2023.x line beyond 2023.20); exact fixed build numbers are not included in the provided input, so confirm and install the specific patched version from the advisory rather than an assumed number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running ColdFusion 2025.9 or 2023.20 or earlier; alert end users to avoid opening untrusted files; enable email filtering for file types processed by ColdFusion. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Coldfusion
View allUnspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or acc
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Acces
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerabi
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerabili
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 1
Path traversal in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets remote attackers (PR:N) read arbitrary
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today