CVE-2026-34634: Server-Side Request Forgery (SSRF) (CWE-918) in Adobe ColdFusion 2025

CVE-2026-34634 is a Server-Side Request Forgery (SSRF) vulnerability in Adobe ColdFusion 2025 that allows an attacker to cause the server to make unauthorized requests. This vulnerability can be exploited without any user interaction and results in privilege escalation, with a changed scope indicating that the vulnerability affects resources beyond the initial vulnerable component. The CVSS 3.1 base score is 8.6, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, changed scope, and high confidentiality impact but no integrity or availability impact. The affected versions include ColdFusion versions up to 2025.0.13 and 2023.0.25.

Successful exploitation of this SSRF vulnerability can lead to privilege escalation on the affected ColdFusion server, potentially allowing attackers to access or manipulate resources with elevated privileges. The confidentiality of information is highly impacted, but integrity and availability are not affected according to the CVSS vector. No user interaction is required for exploitation, increasing the risk of automated or remote attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Users should monitor Adobe's official security advisories for updates and apply patches once they become available. Until then, consider restricting network access and applying any recommended temporary mitigations from Adobe if published.