CVE-2026-83961CWE-287

CVE-2026-83961

High · published September 3, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-03T20:18Z
Affected products (35)
ProductVersionsFixed in
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
adobe/coldfusionall versions—
References (1)
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 15:27Z
    ColdFusion | Improper Authentication (CWE-287)
    cvelistv5