EUVD-2026-56549
GHSA-cvv7-94jv-5mcv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Low-privileged network-accessible exploitation with no user interaction; scope change and high integrity impact reflect OS command injection writing beyond the application boundary.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass security controls and gain unauthorized write access to resources outside the application's normal permission boundary. The CVSS scope-change metric (S:C) confirms impact extends beyond the vulnerable component itself, meaning successful exploitation can affect the underlying operating system or adjacent system resources. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make this a credible risk for any internet-exposed or internally accessible ColdFusion deployment.
Technical ContextAI
CWE-78 (Improper Neutralization of Special Elements used in an OS Command) identifies the root cause as unsanitized user-controlled input being passed to an OS-level shell or command execution function. In ColdFusion's context, CFML tags and built-in functions such as cfexecute or underlying Java runtime calls can be vectors if input reaches them without adequate filtering. The CVSS scope change (S:C) is technically significant: it indicates the command injection escapes ColdFusion's application security boundary and affects resources controlled by the host OS or adjacent components - consistent with an attacker running OS commands under the application server's process identity. Affected products are precisely scoped by CPE to cpe:2.3:a:adobe:coldfusion_2025:*:*:*:*:*:*:*:* and cpe:2.3:a:adobe:coldfusion_2023:*:*:*:*:*:*:*:*, covering all sub-versions of both the 2023 and 2025 release lines.
RemediationAI
Apply the update detailed in Adobe Security Bulletin APSB26-90, available at https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html. Exact fixed version numbers must be sourced from that advisory, as they are not independently confirmed in the data available for this analysis. As compensating controls while patching is in progress: restrict network-level access to ColdFusion instances using firewall rules or network segmentation so only trusted hosts can reach the application - this raises the effective attack vector from fully network-accessible to a narrower perimeter, at the cost of limiting legitimate remote access. Audit and disable any ColdFusion features or CFML tags (e.g., cfexecute, runtime expression evaluation) that permit user-controlled input to reach OS command execution paths, accepting that this may break application functionality that depends on those features. Enforce strict input validation and allowlisting at the web application firewall layer for ColdFusion endpoints that accept user-supplied parameters. Ensure ColdFusion application server processes run under a least-privileged OS account to limit the blast radius of any command injected - this does not eliminate the vulnerability but constrains what an attacker can write to.
More in Coldfusion 2025
View allOS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary op
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorizati
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthoriz
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrat
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authoriz
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass securit
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security c
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitra
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptogra
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security co
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today