CVE-2026-47930: ColdFusion | Improper Input Validation (CWE-20)

Synopsis

Improper input validation in Adobe ColdFusion (versions 2023.19, 2025.8 and earlier) allows a network-accessible attacker with a low-privilege account to bypass security controls. The vulnerability is reachable over the network without any victim interaction, and successful exploitation grants unauthorized read and write access to protected resources. No fix version has been published yet; HarborGuard tracks the advisory and will surface patch availability as soon as Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ColdFusion service over the network; the vulnerable component is network-exposed (AV:N).

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials (PR:L).

• Victim interactionNot required

  Exploitation proceeds without any action from a logged-in user or administrator (UI:N).

• Attack complexityDetail

  No special conditions, race conditions, or unusual environmental factors are needed; the exploit is reliable and repeatable (AC:L).

Blast Radius

• A successful attacker reads data protected by the bypassed security controls, including application data and potentially session or credential material.
• A successful attacker writes to or modifies protected resources, enabling data tampering or injection of malicious content.
• The bypass nature of the vulnerability means it can serve as a stepping stone to chain with other vulnerabilities that require higher privilege.