Adobe ColdFusion EUVD-2026-56536

Exploitation requires an authenticated local session on the ColdFusion 2023 or 2025 host - the CVSS attack vector is Local (AV:L), meaning remote-only attackers cannot exploit this vulnerability directly without first establishing local code execution or an interactive session on the target. A low-privileged account is sufficient (PR:L); no administrative or elevated operating system credentials are needed. No user interaction is required (UI:N). The specific ColdFusion internal feature, API endpoint, or authorization check that is incorrectly implemented is not identified in the available data; the vendor advisory APSB26-90 should be consulted for feature-level specifics. Exploitation is limited to environments where untrusted or semi-trusted users have local system access to the ColdFusion server.

The CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent: local vector limits the attacker pool significantly, but once local access exists, the low complexity and full CIA impact make exploitation straightforward and impactful. EPSS data was not provided, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA KEV and no public POC has been identified, suggesting opportunistic mass exploitation is not currently occurring. Real-world risk is highest on ColdFusion deployments where the server is multi-tenant or accessible to multiple internal users with varying trust levels; even a mid-sized municipal IT team in ustka running shared ColdFusion infrastructure should treat this as urgent pending patching, given that local privilege escalation can pivot to full server compromise. The absence of EPSS and KEV data means the exploitation urgency signal is incomplete - prioritization should lean on the high CIA impact and vendor-confirmed nature of the flaw.

An attacker who has obtained a low-privileged local account on a ColdFusion server - whether through credential theft, a separate initial-access vulnerability, or legitimate guest access - invokes the flawed authorization path to bypass access controls and gain read and write access to resources beyond their permission level. With full integrity impact (I:H), the attacker could modify ColdFusion application files, configuration, or data, potentially enabling persistent access or lateral movement. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates exploitation would be technically straightforward for an attacker already on the system.