CVE-2026-83961— ColdFusion | Improper Authentication (CWE-287)
Quick assessment
Affected
Adobe ColdFusion 2025
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ColdFusion 存在一个身份验证不当（Improper Authentication）漏洞，可能导致权限提升。攻击者可利用此漏洞获得有限的读取和写入访问权限。受影响的组件默认情况下被限制在管理网络区域内。利用该问题无需用户交互。影响范围已发生变更。
Possible ATT&CK Techniques 1 AI
T1110 · Brute ForceAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Adobe | ColdFusion 2023 | ≤ 2023.0.22 |
affected |
2023.0.23 |
unaffected | ||
| Adobe | ColdFusion 2025 | ≤ 2025.0.11 |
affected |
2025.0.12 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-83961
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ColdFusion | Improper Authentication (CWE-287)
Source: CVE Program / CVE List V5
Vulnerability Description
ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | ColdFusion 2025 | 0 ~ 2025.0.11 | - |
|
| Adobe | ColdFusion 2023 | 0 ~ 2023.0.22 | - |
|
II. Public POCs for CVE-2026-83961
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-83961
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-83961 (1)
IV. Related Vulnerabilities
Same product: ColdFusion 2025
-
CVE-2026-71387
ColdFusion | Incorrect Authorization (CWE-863) -
CVE-2026-48385
ColdFusion | Improper Neutralization of Special Elements use -
CVE-2026-71383
ColdFusion | Incorrect Authorization (CWE-863) -
CVE-2026-21279
ColdFusion | Improper Input Validation (CWE-20) -
CVE-2026-48384
ColdFusion | Improper Input Validation (CWE-20)
Same vendor: Adobe
-
CVE-2026-83959
Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) -
CVE-2026-34616
DNG SDK | Out-of-bounds Read (CWE-125) -
CVE-2026-34620
DNG SDK | Out-of-bounds Write (CWE-787) -
CVE-2026-34674
Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) -
CVE-2026-75750
Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)
Same weakness: CWE-287
-
CVE-2026-84831
Mandatory MFA bypass before enrollment -
CVE-2026-84114
Cleo Harmony SAML Authentication LocalUserUtil.getNativeUser -
CVE-2026-77194
Simple Membership <= 4.8.1 - Unauthenticated Authentication -
CVE-2026-19806
Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authen -
CVE-2026-61641
Wallos: OIDC account takeover via email-based account linkin
V. Comments for CVE-2026-83961
No comments yet