Adobe ColdFusion EUVD-2026-70530

Exploitation requires network adjacency to the ColdFusion administrative network zone - by default, the admin interface is confined to this zone, so the attacker must already have access to that segment (e.g., management VLAN, jump host, or compromised internal host). No authentication credentials are required (PR:N - this is the authentication bypass itself). No user interaction is needed. The attack does not require any non-default configuration; the flaw exists in the default deployment of ColdFusion 2023 and 2025. Exploitation is limited by the adjacent-network requirement: internet-facing exploitation is not possible unless the administrative interface has been misconfigured to be externally reachable. The impact is further bounded by the 'limited read and write access' characterization in the description.

The CVSS 7.1 rating with AV:A accurately captures the primary mitigating factor: the vulnerable admin component is isolated to an administrative network zone by default, meaning attackers must already have access to that segment. This substantially limits opportunistic internet-facing exploitation, in contrast to AV:N vulnerabilities. AC:L and PR:N confirm no special conditions or pre-existing credentials are required once network adjacency is achieved. The S:C metric elevates concern because a breach of the admin component can cascade to broader system impact. EPSS data is not provided in the input, and the vulnerability is not listed in CISA KEV, nor is any proof-of-concept code identified. Real-world priority is moderate: organizations with improperly segmented ColdFusion admin interfaces (e.g., admin zone reachable from broader internal networks or via VPN) face meaningfully elevated risk. The limited C:L/I:L/A:L impact metrics align with the description's 'limited read and write access' characterization, making this a privilege escalation rather than a full-compromise vector.

An attacker with access to the administrative network segment - such as a malicious insider, a compromised host on the management VLAN, or an attacker who has already pivoted through the network - sends crafted unauthenticated requests to the ColdFusion administrative interface, bypassing authentication controls. This grants the attacker limited read and write access to ColdFusion configuration or data, with the scope change indicating potential lateral impact on other system components. No public proof-of-concept has been identified at time of analysis.