ColdFusion | Improper Input Validation (CWE-20)
Summary
| CVE | CVE-2026-47931 |
|---|---|
| State | PUBLISHED |
| Assigner | adobe |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-09 21:17:23 UTC |
| Updated | 2026-08-05 17:32:41 UTC |
| Description | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed. |
Risk And Classification
Primary CVSS: v3.1 8.4 HIGH from [email protected]
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.002420000 probability, percentile 0.153130000 (date 2026-08-09)
Problem Types: CWE-20 | NVD-CWE-noinfo | CWE-20 Improper Input Validation (CWE-20)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 8.4 | HIGH | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | [email protected] | Secondary | 8.4 | HIGH | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 8.4 | HIGH | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
HighUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Adobe | Coldfusion | 2023 | - | All | All |
| Application | Adobe | Coldfusion | 2023 | update1 | All | All |
| Application | Adobe | Coldfusion | 2023 | update10 | All | All |
| Application | Adobe | Coldfusion | 2023 | update11 | All | All |
| Application | Adobe | Coldfusion | 2023 | update12 | All | All |
| Application | Adobe | Coldfusion | 2023 | update13 | All | All |
| Application | Adobe | Coldfusion | 2023 | update14 | All | All |
| Application | Adobe | Coldfusion | 2023 | update15 | All | All |
| Application | Adobe | Coldfusion | 2023 | update16 | All | All |
| Application | Adobe | Coldfusion | 2023 | update17 | All | All |
| Application | Adobe | Coldfusion | 2023 | update18 | All | All |
| Application | Adobe | Coldfusion | 2023 | update19 | All | All |
| Application | Adobe | Coldfusion | 2023 | update2 | All | All |
| Application | Adobe | Coldfusion | 2023 | update3 | All | All |
| Application | Adobe | Coldfusion | 2023 | update4 | All | All |
| Application | Adobe | Coldfusion | 2023 | update5 | All | All |
| Application | Adobe | Coldfusion | 2023 | update6 | All | All |
| Application | Adobe | Coldfusion | 2023 | update7 | All | All |
| Application | Adobe | Coldfusion | 2023 | update8 | All | All |
| Application | Adobe | Coldfusion | 2023 | update9 | All | All |
| Application | Adobe | Coldfusion | 2025 | - | All | All |
| Application | Adobe | Coldfusion | 2025 | update1 | All | All |
| Application | Adobe | Coldfusion | 2025 | update2 | All | All |
| Application | Adobe | Coldfusion | 2025 | update3 | All | All |
| Application | Adobe | Coldfusion | 2025 | update4 | All | All |
| Application | Adobe | Coldfusion | 2025 | update5 | All | All |
| Application | Adobe | Coldfusion | 2025 | update6 | All | All |
| Application | Adobe | Coldfusion | 2025 | update7 | All | All |
| Application | Adobe | Coldfusion | 2025 | update8 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Adobe | ColdFusion | affected 2023.19 semver | Not specified |
| CNA | Adobe | ColdFusion | affected 2025.8 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| helpx.adobe.com/security/products/coldfusion/apsb26-64.html | [email protected] | helpx.adobe.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.