CVE-2026-47929 is an Incorrect Authorization vulnerability in Adobe ColdFusion affecting versions 2023.0.0 to 2023.19 and 2025.0.0 to 2025.8. The flaw allows a high-privileged attacker to execute arbitrary code with the privileges of the current user. Exploitation does not require user interaction and results in a changed security scope, potentially enabling elevated access or control over victim accounts or sessions. The CVSS v3.1 base score is 8.4, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation could lead to arbitrary code execution in the context of the current user, potentially allowing an attacker with high privileges to gain elevated access or control over victim accounts or sessions. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor Adobe's security advisories for updates and apply patches once available.