CVE-2026-21273 is an Improper Input Validation vulnerability in Adobe ColdFusion 2025. It allows a low-privileged attacker to escalate privileges by exploiting insufficient validation of input, resulting in unauthorized read and write access. Exploitation requires user interaction, such as opening a malicious file, and the vulnerability impacts confidentiality and integrity with a changed scope. The CVSS v3.1 base score is 8.7, indicating high severity. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to privilege escalation, unauthorized read and write access to sensitive data, and a change in security scope, potentially compromising system confidentiality and integrity. Availability is not impacted. The attack requires user interaction, limiting the attack vector to scenarios involving a victim opening a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with files received from untrusted sources to prevent exploitation via malicious files.