MA-1476.072026: MyCERT Advisory - Adobe ColdFusion Path Traversal Vulnerability

What happened?

Current assessment

Recently, Adobe has released security updates for ColdFusion versions 2023 and 2025 in its product.

Why it matters

These vulnerabilities could lead to an arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass. An authenticated attacker with low privileges can send crafted requests over the network to access sensitive files on the underlying file system. Exploitation requires no user interaction, and the vulnerability results in a scope change that impacts resources beyond the vulnerable component. Successful exploitation exposes configuration files, credentials, source code, and other sensitive artifacts stored on the server.

Who is affected?

Affected products and groups

• Product: Adobe ColdFusion 2023 (base release through Update 21)Adobe ColdFusion 2025 (base release through Update 10)Any ColdFusion instance exposing administrative or application endpoints to untrusted networks — Product or product group named in the MyCERT advisory.

What should you do now?

Actions from official guidance

Which sources support it?

Evidence and official sources

1. MyCERTOfficial source
   MA-1476.072026: MyCERT Advisory - Adobe ColdFusion Path Traversal Vulnerability

   Recently, Adobe has released security updates for ColdFusion versions 2023 and 2025 in its product.

   Published Just published · Retrieved 01 Aug 2026