CVE-2026-47929 is an Incorrect Authorization vulnerability in Adobe ColdFusion affecting versions 2023.0.0 to 2023.19 and 2025.0.0 to 2025.8. This flaw allows a high-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerable component is typically restricted to an administrative network zone, but successful exploitation changes the security scope, potentially leading to elevated privileges or control over user sessions.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially allowing a high-privileged attacker to gain elevated access or control over victim accounts or sessions. The vulnerability affects confidentiality, integrity, and availability, as reflected in the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and remediation level is not specified, users should monitor Adobe's advisories for updates. The vulnerable component is restricted to an administrative network zone by default, which may limit exposure.