Coldfusion 2023
Monthly
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate privileges and gain limited read and write access to affected systems. The vulnerable administrative component is network-restricted by default, which partially contains exposure, but the scope change indicator in the CVSS vector signals that successful exploitation can affect components beyond the directly targeted service. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authorization controls and execute arbitrary code in the context of the ColdFusion service account. The vulnerable administrative component is confined to an administrative network zone by default, limiting internet-scale exposure but leaving internal networks and misconfigured deployments at significant risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the complete CIA impact and zero-authentication requirement make this a high-priority patch target for any organization running ColdFusion.
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass security controls and gain unauthorized write access to resources outside the application's normal permission boundary. The CVSS scope-change metric (S:C) confirms impact extends beyond the vulnerable component itself, meaning successful exploitation can affect the underlying operating system or adjacent system resources. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make this a credible risk for any internet-exposed or internally accessible ColdFusion deployment.
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security controls and gain limited unauthorized read and write access to protected resources, with a limited disruption to availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication, no user interaction, and is reachable over the network under low complexity conditions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security controls, gaining unauthorized read and limited write access to affected systems. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a low-complexity, network-exploitable flaw requiring no privileges or user interaction, elevating real-world risk for any internet-facing ColdFusion deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but ColdFusion's history as a high-value target warrants prompt patching.
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitrary code in the context of the ColdFusion server process. The vulnerability requires high-complexity exploitation conditions outside the attacker's direct control, yielding a CVSS score of 8.1 rather than critical, but the triple-high impact (full confidentiality, integrity, and availability compromise) makes it a high-priority target. No public exploit code or CISA KEV listing has been identified at time of analysis, though ColdFusion's historical targeting by ransomware and state-sponsored actors elevates real-world urgency beyond what the AC:H qualifier alone would suggest.
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass security controls and gain unauthorized read and write access with scope change to components beyond the vulnerable server. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H) confirms local access with minimal complexity is sufficient - no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the deterministic, non-rotating nature of a hard-coded key means any attacker who extracts it retains persistent capability until the key is replaced via patch.
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptographic algorithm (CWE-327), enabling a remote unauthenticated attacker to retrieve confidential data - such as session tokens, credentials, or application secrets - that transit or reside in vulnerable cryptographic operations. Both the 2023 and 2025 product lines are confirmed affected per Adobe's own CPE data. No user interaction is required, and the CVSS vector confirms full network exploitability against default deployments. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary operating-system commands in the context of the ColdFusion service account. Rated CVSS 10.0 with a scope change (S:C), this flaw stems from improper neutralization of special elements passed into an OS command and requires no user interaction. No public exploit identified at time of analysis, but ColdFusion's history as an attacker-favored target makes rapid patching essential.
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorization checks (CWE-863, Incorrect Authorization) and obtain unauthorized read and write access, potentially forcing an application denial-of-service. The flaw carries a CVSS 9.6 (scope-changed) rating and requires no user interaction, though the vulnerable component sits inside an administrative network zone by default. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat the 9.6 as high potential rather than confirmed active abuse.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and write access through an Incorrect Authorization flaw (CWE-863). Exploitation requires only a low-privileged local account and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system. Adobe has published advisory APSB26-90; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthorized read and write access beyond their authorized security scope by exploiting improper input validation in file processing. The attack requires social engineering - a victim with higher privileges must open a specially crafted malicious file - after which the attacker's effective permissions cross security boundaries (scope change, S:C) to reach resources outside the original ColdFusion component. No public exploit or CISA KEV listing has been identified at time of analysis, though the high CVSS score of 8.7 and scope-change impact warrant prompt remediation per Adobe advisory APSB26-90.
Improper input validation in Adobe ColdFusion 2023 and 2025 allows a remote attacker holding high-privileged credentials to crash the application server via a crafted network request, producing a denial-of-service condition. Affected versions are ColdFusion 2023 ≤ 2023.0.22 and ColdFusion 2025 ≤ 2025.0.11, with vendor-released patches documented in Adobe Security Bulletin APSB26-90. No public exploit code or confirmed active exploitation has been identified at time of analysis.
ColdFusion 2023 and 2025 contain an Incorrect Authorization flaw (CWE-863) that allows any low-privileged authenticated user to remotely crash the application server, producing a denial-of-service condition. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only network access and a valid low-privilege credential with no interaction from other users, making repeated service disruption trivial for any credentialed attacker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe ColdFusion 2023 (≤2023.0.22) and 2025 (≤2025.0.11) allows a low-privileged attacker to persist malicious JavaScript in vulnerable form fields, which then executes in the browsers of other users who view the affected page. The CVSS scope change (S:C) reflects that injected scripts can impact users beyond the attacker's own session - including potentially higher-privileged administrators. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial at time of analysis.
ColdFusion 2023 and ColdFusion 2025 contain an improper output encoding flaw (CWE-116) enabling low-privileged network attackers to circumvent security controls, achieve limited unauthorized write access, and cause modest availability disruption. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-reachable, requires only a low-privileged account, and needs no user interaction. No public exploit code has been identified and CISA SSVC assigns exploitation status of none; vendor-released patches are available as ColdFusion 2023 update 2023.0.23 and ColdFusion 2025 update 2025.0.12 per Adobe advisory APSB26-90.
Improper authentication in Adobe ColdFusion 2023 and 2025 allows unauthenticated adjacent-network attackers to escalate privileges and gain limited read and write access to affected systems. The vulnerable administrative component is network-restricted by default, which partially contains exposure, but the scope change indicator in the CVSS vector signals that successful exploitation can affect components beyond the directly targeted service. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect Authorization (CWE-863) in Adobe ColdFusion 2023 and 2025 allows adjacent-network attackers to bypass authorization controls and execute arbitrary code in the context of the ColdFusion service account. The vulnerable administrative component is confined to an administrative network zone by default, limiting internet-scale exposure but leaving internal networks and misconfigured deployments at significant risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the complete CIA impact and zero-authentication requirement make this a high-priority patch target for any organization running ColdFusion.
OS command injection in Adobe ColdFusion 2023 and 2025 allows a low-privileged, network-authenticated attacker to bypass security controls and gain unauthorized write access to resources outside the application's normal permission boundary. The CVSS scope-change metric (S:C) confirms impact extends beyond the vulnerable component itself, meaning successful exploitation can affect the underlying operating system or adjacent system resources. No public exploit has been identified at time of analysis, but the low attack complexity and low privilege requirement make this a credible risk for any internet-exposed or internally accessible ColdFusion deployment.
Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security controls and gain limited unauthorized read and write access to protected resources, with a limited disruption to availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication, no user interaction, and is reachable over the network under low complexity conditions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Improper Input Validation in Adobe ColdFusion 2023 and 2025 allows unauthenticated remote attackers to bypass security controls, gaining unauthorized read and limited write access to affected systems. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a low-complexity, network-exploitable flaw requiring no privileges or user interaction, elevating real-world risk for any internet-facing ColdFusion deployment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but ColdFusion's history as a high-value target warrants prompt patching.
Heap-based buffer overflow in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to execute arbitrary code in the context of the ColdFusion server process. The vulnerability requires high-complexity exploitation conditions outside the attacker's direct control, yielding a CVSS score of 8.1 rather than critical, but the triple-high impact (full confidentiality, integrity, and availability compromise) makes it a high-priority target. No public exploit code or CISA KEV listing has been identified at time of analysis, though ColdFusion's historical targeting by ransomware and state-sponsored actors elevates real-world urgency beyond what the AC:H qualifier alone would suggest.
Hard-coded cryptographic key in Adobe ColdFusion 2023 and 2025 enables a local low-privileged attacker to bypass security controls and gain unauthorized read and write access with scope change to components beyond the vulnerable server. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H) confirms local access with minimal complexity is sufficient - no user interaction is needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the deterministic, non-rotating nature of a hard-coded key means any attacker who extracts it retains persistent capability until the key is replaced via patch.
Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptographic algorithm (CWE-327), enabling a remote unauthenticated attacker to retrieve confidential data - such as session tokens, credentials, or application secrets - that transit or reside in vulnerable cryptographic operations. Both the 2023 and 2025 product lines are confirmed affected per Adobe's own CPE data. No user interaction is required, and the CVSS vector confirms full network exploitability against default deployments. No public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in Adobe ColdFusion 2023 and 2025 enables remote, unauthenticated attackers to execute arbitrary operating-system commands in the context of the ColdFusion service account. Rated CVSS 10.0 with a scope change (S:C), this flaw stems from improper neutralization of special elements passed into an OS command and requires no user interaction. No public exploit identified at time of analysis, but ColdFusion's history as an attacker-favored target makes rapid patching essential.
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.
Security feature bypass in Adobe ColdFusion 2023 and 2025 lets attackers with adjacent network access defeat authorization checks (CWE-863, Incorrect Authorization) and obtain unauthorized read and write access, potentially forcing an application denial-of-service. The flaw carries a CVSS 9.6 (scope-changed) rating and requires no user interaction, though the vulnerable component sits inside an administrative network zone by default. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat the 9.6 as high potential rather than confirmed active abuse.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged local user to gain unauthorized read and write access through an Incorrect Authorization flaw (CWE-863). Exploitation requires only a low-privileged local account and no user interaction, yielding full confidentiality, integrity, and availability impact on the affected system. Adobe has published advisory APSB26-90; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Adobe ColdFusion 2023 and 2025 allows a low-privileged authenticated attacker to gain unauthorized read and write access beyond their authorized security scope by exploiting improper input validation in file processing. The attack requires social engineering - a victim with higher privileges must open a specially crafted malicious file - after which the attacker's effective permissions cross security boundaries (scope change, S:C) to reach resources outside the original ColdFusion component. No public exploit or CISA KEV listing has been identified at time of analysis, though the high CVSS score of 8.7 and scope-change impact warrant prompt remediation per Adobe advisory APSB26-90.
Improper input validation in Adobe ColdFusion 2023 and 2025 allows a remote attacker holding high-privileged credentials to crash the application server via a crafted network request, producing a denial-of-service condition. Affected versions are ColdFusion 2023 ≤ 2023.0.22 and ColdFusion 2025 ≤ 2025.0.11, with vendor-released patches documented in Adobe Security Bulletin APSB26-90. No public exploit code or confirmed active exploitation has been identified at time of analysis.
ColdFusion 2023 and 2025 contain an Incorrect Authorization flaw (CWE-863) that allows any low-privileged authenticated user to remotely crash the application server, producing a denial-of-service condition. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only network access and a valid low-privilege credential with no interaction from other users, making repeated service disruption trivial for any credentialed attacker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in Adobe ColdFusion 2023 (≤2023.0.22) and 2025 (≤2025.0.11) allows a low-privileged attacker to persist malicious JavaScript in vulnerable form fields, which then executes in the browsers of other users who view the affected page. The CVSS scope change (S:C) reflects that injected scripts can impact users beyond the attacker's own session - including potentially higher-privileged administrators. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial at time of analysis.
ColdFusion 2023 and ColdFusion 2025 contain an improper output encoding flaw (CWE-116) enabling low-privileged network attackers to circumvent security controls, achieve limited unauthorized write access, and cause modest availability disruption. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is network-reachable, requires only a low-privileged account, and needs no user interaction. No public exploit code has been identified and CISA SSVC assigns exploitation status of none; vendor-released patches are available as ColdFusion 2023 update 2023.0.23 and ColdFusion 2025 update 2025.0.12 per Adobe advisory APSB26-90.