Adobe ColdFusion EUVD-2026-56541

Exploitation requires a local OS-level account with low privileges on the host running Adobe ColdFusion 2023 or 2025 - sufficient to read ColdFusion installation files or interact with the application process. The CVSS vector (AV:L/PR:L) confirms this: network-based unauthenticated exploitation is not possible. No user interaction is required once local access is established. No special application configuration or non-default feature flag is described as a prerequisite - the hard-coded key appears to be present in default installations of both affected release lines. Exploitation is limited by the requirement for local system access; remote-only attackers cannot exploit this directly without first compromising a local account through another vector. The scope change (S:C) means that once the key is recovered, impact extends beyond just the ColdFusion application to other security-enforcing components on or connected to the host.

The CVSS 8.4 (High) score reflects meaningful real-world risk grounded in concrete impact signals. The vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N shows local access with low privileges and low attack complexity - straightforward to exploit once access is obtained. The scope change (S:C) elevates risk significantly, as a successful attacker can compromise security controls that protect resources outside the ColdFusion application tier. No EPSS data was provided in the intelligence feed, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation at this time. No public POC was identified. However, hard-coded key vulnerabilities are particularly dangerous because the key can be extracted through static binary analysis, reverse engineering, or configuration file inspection - all achievable with low-privileged local access and standard tooling. The availability of both 2023 and 2025 product lines in the CPE data indicates a broad vulnerable install base. The absence from KEV should not be interpreted as low urgency - ColdFusion has historically been a high-value target in government and enterprise environments.

An attacker with a low-privileged OS account on a ColdFusion server - such as a shared hosting tenant, an internal employee, or an attacker who achieved initial access via a separate vulnerability - uses static analysis or file inspection to extract the hard-coded cryptographic key from ColdFusion binaries or configuration artifacts. The attacker then uses this key to forge or decrypt cryptographic tokens that ColdFusion relies on for security enforcement, bypassing authentication or authorization checks and obtaining unauthorized read and write access to application data and potentially downstream components within the changed scope.