CVE-2026-34619 is a path traversal vulnerability in Adobe ColdFusion that improperly limits pathname access to restricted directories. This flaw enables attackers with low privileges to bypass security controls and access files or directories outside the intended scope. The vulnerability affects ColdFusion versions 2023.18, 2025.6, and earlier. Exploitation does not require user interaction and can lead to denial of service (availability impact). The CVSS v3.1 base score is 7.7, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with availability impact.

Successful exploitation allows an attacker to bypass security restrictions and access unauthorized files or directories, potentially causing denial of service. There is no confidentiality or integrity impact reported. The vulnerability can be exploited remotely without user interaction, increasing its risk profile. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or temporary fix has been provided by Adobe, users should monitor Adobe's security advisories for updates. Until a fix is available, consider restricting network access to ColdFusion instances and applying compensating controls to limit exposure.