What is the CVSS score of EUVD-2026-56536?

EUVD-2026-56536 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Adobe ColdFusion are affected by EUVD-2026-56536?

Adobe ColdFusion 2023 and 2025 versions are affected by a privilege escalation vulnerability (CVE-2026-25652) that enables local system users to gain unauthorized access to data and system functions.

How to fix or mitigate EUVD-2026-56536?

Within 24 hours, audit your infrastructure to identify all Adobe ColdFusion 2023 and 2025 instances and categorize them by criticality and data sensitivity using your CMDB or asset inventory tools. Within 7 days, implement access controls by restricting login privileges to ColdFusion-hosting systems to only essential administrators, and enable detailed logging of authentication and privilege escalation events for real-time detection. Within 30 days, engage Adobe through your support channels to establish patching timelines, and develop contingency plans such as network segmentation or application migration to minimize exposure until a vendor patch is released.

Adobe ColdFusion EUVD-2026-56536

| CVE-2026-25652 HIGH

Incorrect Authorization (CWE-863)

2026-08-11 adobe

GHSA-594v-hg23-fp42

Authentication Bypass Privilege Escalation Adobe Coldfusion 2025 Coldfusion 2023

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and low-privilege requirement align with a post-authentication authorization bypass on a locally-accessed service; full CIA impact reflects unrestricted read/write access gained upon exploitation.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 17:27 vuln.today

CVE Published

Aug 11, 2026 - 16:30 nvd

HIGH 7.8

DescriptionCVE.org

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

AnalysisAI

Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and write access through an Incorrect Authorization flaw (CWE-863). Exploitation requires only a low-privileged local account and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system. Adobe has published advisory APSB26-90; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Adobe ColdFusion is an enterprise-grade web application development and runtime platform. CWE-863 (Incorrect Authorization) describes a failure in the authorization enforcement layer - the system correctly identifies the user but improperly validates what resources or operations that user is permitted to access, distinct from authentication bypass (CWE-287). Both ColdFusion 2023 (CPE: cpe:2.3:a:adobe:coldfusion_2023:*:*:*:*:*:*:*:*) and ColdFusion 2025 (CPE: cpe:2.3:a:adobe:coldfusion_2025:*:*:*:*:*:*:*:*) are confirmed affected across all sub-versions per NVD CPE data. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-complexity exploit path requiring only a low-privileged account, with no scope change to external systems.

RemediationAI

Apply the patches specified in Adobe security bulletin APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html); exact fixed version numbers must be confirmed from the advisory, as the CPE data uses wildcards and no specific fix version was included in the provided intelligence. As compensating controls prior to patching, restrict local operating system access to ColdFusion server hosts to only explicitly authorized personnel, run the ColdFusion service under a dedicated least-privilege service account isolated from sensitive data paths, and audit all local user accounts and group memberships on affected hosts. Note that access restriction reduces the attacker pool but does not remediate the underlying authorization flaw - patching remains the authoritative fix.