EUVD-2026-56539
GHSA-cwg8-vmr8-7377
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable, unauthenticated OS command injection with no user interaction gives AV:N/AC:L/PR:N/UI:N, and code execution escaping to the host justifies S:C with full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
OS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary operating-system commands in the context of the ColdFusion service account. Rated CVSS 10.0 with a scope change (S:C), this flaw stems from improper neutralization of special elements passed into an OS command and requires no user interaction. No public exploit identified at time of analysis, but ColdFusion's history as an attacker-favored target makes rapid patching essential.
Technical ContextAI
Adobe ColdFusion is a commercial rapid web-application platform built on the JVM that renders CFML templates and exposes numerous administrative and runtime services. The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning attacker-influenced input reaches a shell or process-execution call without adequate sanitization, allowing command metacharacters to break out of the intended argument and launch new OS processes. The CPE data pins the affected software to cpe:2.3:a:adobe:coldfusion_2025 and cpe:2.3:a:adobe:coldfusion_2023, and the scope-change (S:C) in the CVSS vector indicates the exploited component (the ColdFusion application) can affect resources beyond its own security authority, i.e. the underlying host OS.
RemediationAI
Apply the fixes described in Adobe security bulletin APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html) for both ColdFusion 2023 and ColdFusion 2025; the input data does not specify an exact fixed build number, so consult the advisory for the precise patched version and install it promptly (Patch available per vendor advisory). Until patched, reduce exposure by restricting network access to the ColdFusion Administrator and any affected endpoints via firewall/IP allowlisting, placing the server behind a WAF with rules to block OS command metacharacters, running the ColdFusion service under a least-privileged account to limit the impact of the scope change, and applying Adobe's lockdown guide - noting that aggressive WAF rules or endpoint restrictions may break legitimate application functionality and should be tested before broad rollout.
More in Coldfusion 2025
View allSecurity feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorizati
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authoriz
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security c
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitra
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today