CVE-2026-47929
Published: 09 June 2026
Summary
CVE-2026-47929 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Adobe Coldfusion. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-24 (Access Control Decisions).
Deeper analysis
ColdFusion versions 2023.19, 2025.8 and earlier contain an Incorrect Authorization vulnerability, tracked as CVE-2026-47929 and assigned CWE-863. The flaw permits arbitrary code execution in the context of the current user and carries a CVSS 3.1 score of 8.4 with a changed scope.
A high-privileged attacker with network adjacency can exploit the issue without user interaction or any special conditions beyond the required privileges. Successful exploitation grants the attacker elevated access sufficient to control the victim's account or session and to execute arbitrary code.
Adobe has published advisory APSB26-64 at https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html that addresses the vulnerability and provides mitigation guidance for affected ColdFusion installations. The associated EPSS score remains flat at 0.0754 with no material increase observed after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-35833
Vulnerability details
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to gain elevated access or control…
more
over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Incorrect authorization flaw in ColdFusion (public-facing web platform) directly enables remote arbitrary code execution by an authenticated network-adjacent attacker.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization decisions to block the incorrect authorization checks that allow a high-privileged attacker to execute arbitrary code.
Limits privileges assigned to accounts so that even a compromised high-privileged session cannot reach the elevated access needed for code execution.
Ensures access-control decisions are made and enforced correctly before permitting actions that lead to arbitrary code execution.