Threat database

Adobe ColdFusion 2025 contains an Uncontrolled Resource Consumption vulnerability (CWE-400) that can lead to application denial-of-service. This vulnerability allows an attacker to exhaust system resources without requiring user interaction, causing the application to become unavailable. The issue affects versions up to and including 2025.0.13 and 2023.0.25. The vulnerability has a high severity rating with a CVSS score of 7.5.

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

Adobe ColdFusion 2025 contains a critical path traversal vulnerability (CVE-2026-90530) in its Remote Development Services (RDS) feature. This flaw allows an attacker to read arbitrary files on the file system outside the intended restricted directories without requiring user interaction. The vulnerability affects ColdFusion versions up to 2025.0.13 and 2023.0.25. RDS is intended only for development and is disabled when ColdFusion is set to Production Secure Profile. Disabling RDS or running ColdFusion in Production Secure Profile mitigates the risk.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and can lead to high impact on confidentiality, integrity, and availability.

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker to execute arbitrary code with the privileges of the current user. The vulnerable component is by default restricted to an administrative network zone. Exploitation does not require user interaction and changes the security scope. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The CVSS score is 9.6, indicating critical severity.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-34634) that can lead to privilege escalation without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component. The CVSS score is 8.6, reflecting a high severity issue with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability impacts are none.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security controls and gain unauthorized write access without user interaction. This vulnerability affects versions up to and including 2025.0.13 and 2023.0.25. The vulnerability changes the security scope and has a critical severity with a CVSS score of 9.6.

Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-76001) that allows a low-privileged attacker to potentially escalate privileges by accessing internal resources. The vulnerability does not require user interaction but depends on conditions outside the attacker's control. It affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and has a high severity rating.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that allows an attacker with high privileges to execute arbitrary code without user interaction. The vulnerable component is typically restricted to an administrative network zone. This vulnerability changes the security scope and can lead to full compromise of confidentiality, integrity, and availability.

Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-75748) that allows an attacker with high privileges to escalate access to internal resources without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and has a high severity rating with a CVSS score of 7.6.

Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that can be exploited to cause an application denial-of-service (DoS). This vulnerability allows an attacker to crash the application without requiring any user interaction. The issue affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity rating with a CVSS score of 7.5.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker with high privileges to execute arbitrary code without user interaction. The vulnerable component is by default restricted to an administrative network zone. This vulnerability changes the security scope and can lead to full compromise of the affected system.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that may allow an attacker to disclose sensitive memory information without requiring user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue has a high severity with a CVSS score of 7.5, indicating a significant confidentiality impact but no integrity or availability impact.

ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.