CVE-2026-47931: ColdFusion | Improper Input Validation (CWE-20)

Synopsis

Improper input validation in Adobe ColdFusion (versions 2025.8 and earlier, including 2023.19 and earlier) allows a network-adjacent attacker with administrative credentials to execute arbitrary code on the host in the context of the current user. The vulnerability requires no victim interaction and carries a changed scope, meaning a successful exploit can break out of the directly affected component and impact other system resources. No fix versions have been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild as soon as Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network (LAN, VPN, or equivalent broadcast domain) to reach the vulnerable ColdFusion service; remote internet access alone is not sufficient.

• AuthenticationRequired

  An administrator-level account is needed to trigger the vulnerability, so the attacker must first obtain or compromise privileged credentials.

• Victim interactionNot required

  No user action is needed; the attacker can complete the exploit entirely without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Executes arbitrary code on the ColdFusion host in the context of the current user, giving the attacker direct process-level control.
• Reads any data accessible to the running ColdFusion process, including application configuration files, data source credentials, and session tokens.
• Modifies or deletes files, application data, and configuration accessible to the process, potentially corrupting application state.
• Because scope is changed, impact can extend beyond the ColdFusion component itself to other resources and services on the same host or internal network.