ColdFusion | Incorrect Authorization (CWE-863)

Summary

CVE	CVE-2026-47929
State	PUBLISHED
Assigner	adobe
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-06-09 21:17:22 UTC
Updated	2026-08-05 17:32:37 UTC
Description	ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

Primary CVSS: v3.1 8.4 HIGH from [email protected]

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.020920000 probability, percentile 0.798520000 (date 2026-08-09)

Problem Types: CWE-863 | CWE-863 Incorrect Authorization (CWE-863)

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	8.4	HIGH	`CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
3.1	[email protected]	Secondary	8.4	HIGH	`CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
3.1	CNA	CVSS	8.4	HIGH	`CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Application	Adobe	Coldfusion	2023	-	All	All
Application	Adobe	Coldfusion	2023	update1	All	All
Application	Adobe	Coldfusion	2023	update10	All	All
Application	Adobe	Coldfusion	2023	update11	All	All
Application	Adobe	Coldfusion	2023	update12	All	All
Application	Adobe	Coldfusion	2023	update13	All	All
Application	Adobe	Coldfusion	2023	update14	All	All
Application	Adobe	Coldfusion	2023	update15	All	All
Application	Adobe	Coldfusion	2023	update16	All	All
Application	Adobe	Coldfusion	2023	update17	All	All
Application	Adobe	Coldfusion	2023	update18	All	All
Application	Adobe	Coldfusion	2023	update19	All	All
Application	Adobe	Coldfusion	2023	update2	All	All
Application	Adobe	Coldfusion	2023	update3	All	All
Application	Adobe	Coldfusion	2023	update4	All	All
Application	Adobe	Coldfusion	2023	update5	All	All
Application	Adobe	Coldfusion	2023	update6	All	All
Application	Adobe	Coldfusion	2023	update7	All	All
Application	Adobe	Coldfusion	2023	update8	All	All
Application	Adobe	Coldfusion	2023	update9	All	All
Application	Adobe	Coldfusion	2025	-	All	All
Application	Adobe	Coldfusion	2025	update1	All	All
Application	Adobe	Coldfusion	2025	update2	All	All
Application	Adobe	Coldfusion	2025	update3	All	All
Application	Adobe	Coldfusion	2025	update4	All	All
Application	Adobe	Coldfusion	2025	update5	All	All
Application	Adobe	Coldfusion	2025	update6	All	All
Application	Adobe	Coldfusion	2025	update7	All	All
Application	Adobe	Coldfusion	2025	update8	All	All

Source	Vendor	Product	Version	Platforms
CNA	Adobe	ColdFusion	affected 2023.19 semver	Not specified
CNA	Adobe	ColdFusion	affected 2025.8 semver	Not specified

Reference	Source	Link	Tags
helpx.adobe.com/security/products/coldfusion/apsb26-64.html	[email protected]	helpx.adobe.com	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.