Adobe Coldfusion 2023 vulnerabilities

CVE-2026-21279 [HIGH] CWE-20 CVE-2026-21279: is affected by an Improper Input Validation vulnerability that could result in a Security feature by is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

CVE-2026-34619 [HIGH] CWE-22 CVE-2026-34619: ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this

CVE-2026-71384 [CRITICAL] CWE-863 CVE-2026-71384: is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypa is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The vulnerable component is restricted to an administrati

CVE-2026-90530 [CRITICAL] CWE-22 CVE-2026-90530: ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interac

CVE-2026-34634 [HIGH] CWE-918 CVE-2026-34634: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in pr ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-48332 [HIGH] CWE-918 CVE-2026-48332: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-47929 [HIGH] CWE-863 CVE-2026-47929: ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerabi ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. The vulnerable component is restr

CVE-2026-48327 [CRITICAL] CWE-863 CVE-2026-48327: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary co ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-21273 [HIGH] CWE-20 CVE-2026-21273: is affected by an Improper Input Validation vulnerability that could result in privilege escalation. is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVE-2026-34633 [HIGH] CWE-918 CVE-2026-34633: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in pr ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-48328 [HIGH] CWE-20 CVE-2026-48328: ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106089 [HIGH] CWE-863 CVE-2026-106089: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary co ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-75998 [HIGH] CWE-284 CVE-2026-75998: ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.

CVE-2026-105994 [HIGH] CWE-863 CVE-2026-105994: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security f ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-105901 [HIGH] CWE-863 CVE-2026-105901: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary co ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106617 [HIGH] CWE-863 CVE-2026-106617: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary co ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106615 [HIGH] CWE-863 CVE-2026-106615: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary co ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106090 [HIGH] CWE-863 CVE-2026-106090: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary co ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-106618 [HIGH] CWE-863 CVE-2026-106618: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary co ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-27282 [HIGH] CWE-20 CVE-2026-27282: ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnera ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.