CVE-2026-47928: ColdFusion | Improper Input Validation (CWE-20)

Synopsis

Improper input validation in Adobe ColdFusion (versions 2025.8 and earlier, including 2023.19 and earlier) allows an unauthenticated attacker on the same network segment to execute arbitrary code on the server. No credentials and no victim interaction are needed; the attacker only needs to reach the ColdFusion service from an adjacent network such as a shared LAN, VPN, or cloud subnet. Successful exploitation gives the attacker full code execution, read access to all data the process can reach, and the ability to modify or destroy it. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available the moment Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network (shared LAN, VPN segment, or cloud subnet) to reach the ColdFusion service; remote internet-based access is not sufficient on its own.

• AuthenticationNot required

  No credentials of any kind are needed; the attacker can target the service anonymously.

• Victim interactionNot required

  The exploit completes without any action from a logged-in user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory-layout dependencies, or environmental prerequisites are required.

Blast Radius

• Attacker executes arbitrary code in the context of the ColdFusion server process, gaining an interactive foothold on the host.
• All data readable by the ColdFusion process is exposed, including database credentials, session tokens, and application configuration files.
• Attacker can write, modify, or delete files and database records accessible to the process.
• Because scope is changed (S:C in the CVSS vector), the attacker can pivot beyond the ColdFusion process boundary and affect other components or services sharing the same host or network segment.