CVE-2026-47929: ColdFusion | Incorrect Authorization (CWE-863)

Synopsis

Incorrect Authorization vulnerability in Adobe ColdFusion (versions 2023.19, 2025.8, and earlier) allows a high-privileged attacker reachable over an adjacent network to bypass authorization checks and execute arbitrary code in the context of the current user. No user interaction is required, and successful exploitation changes scope, meaning the attacker can break out of their originally authorized context to affect other components. A successful attack grants full read, write, and availability impact on the target system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Adobe publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment (LAN, VPN, or similar) as the targeted ColdFusion instance; remote over-the-internet exploitation without that adjacency is not supported by this vector.

• AuthenticationRequired

  A high-privileged account (admin-level credentials) is required to reach the vulnerable authorization path; low-privilege or unauthenticated access is not sufficient.

• Victim interactionNot required

  The attacker can complete the exploit entirely without any action from another user or operator.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions, memory-layout dependencies, or other environmental factors need to be satisfied beyond holding a high-privileged account.

Blast Radius

• Reads confidential data stored or accessible in the ColdFusion application context, including session tokens, configuration secrets, and application data.
• Modifies or deletes application data and server-side files within the scope of the running process.
• Crashes or degrades the ColdFusion service, causing availability loss for dependent applications.
• Because scope is changed, the attacker can pivot from the ColdFusion process to affect other system components or co-hosted services beyond the originally compromised application.