EUVD-2026-56537
GHSA-f5fp-2q73-jccr
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent admin-zone reachability gives AV:A with no auth (PR:N) or interaction; incorrect authorization yields high read/write (C:H/I:H) and DoS (A:H) with a changed scope (S:C).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorization checks (CWE-863, Incorrect Authorization) and obtain unauthorized read and write access, potentially forcing an application denial-of-service. The flaw carries a CVSS 9.6 (scope-changed) rating and requires no user interaction, though the vulnerable component sits inside an administrative network zone by default. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat the 9.6 as high potential rather than confirmed active abuse.
Technical ContextAI
Adobe ColdFusion is a commercial rapid-application-development platform and Java-based application server (CFML runtime) used to build and host web applications; the affected builds are ColdFusion 2023 and ColdFusion 2025 per the CPE strings cpe:2.3:a:adobe:coldfusion_2023 and cpe:2.3:a:adobe:coldfusion_2025. The root cause is CWE-863 (Incorrect Authorization): an access-control decision is made incorrectly, so a request that should be denied is instead permitted. Because the CVSS vector marks scope as changed (S:C), the compromised authorization boundary allows impact on resources beyond the vulnerable component's own security authority, which is consistent with an administrative interface that governs broader server state.
RemediationAI
Patch available per vendor advisory: apply the ColdFusion 2023 and ColdFusion 2025 updates described in Adobe security bulletin APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html) and confirm the exact fixed update level there, as no specific fix version is included in this dataset. Until patched, enforce the default posture by keeping the ColdFusion administrator/administrative component confined to a dedicated administrative network zone - restrict access with firewall rules or ACLs so only trusted management hosts on the adjacent segment can reach it, and remove any internet or general-LAN exposure of the admin endpoints; the trade-off is that legitimate remote administration must then be performed through a jump host or VPN. Because the attack vector is Adjacent, network segmentation is the highest-value compensating control here, but it does not substitute for the vendor patch.
More in Coldfusion 2025
View allOS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary op
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authoriz
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security c
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitra
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today