CVE-2026-34633

7.7High

Published 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.7High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-918

Impact

Authenticated attackers with low-privilege accounts can reach internal network resources and escalate privileges via SSRF without user interaction.

Root cause

Improper input validation allows unauthorized server-side requests to internal endpoints (Server-Side Request Forgery).

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Fix & remediation

Check the Adobe advisory APSB26-144 for target patch versions; if immediate patching is not possible, restrict outbound network access from the ColdFusion host to internal infrastructure.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

References

https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html

Source: nvd.nist.gov/vuln/detail/CVE-2026-34633