Executive brief
Adobe ColdFusion is a server-side application development platform used to build dynamic web applications and services. An eval injection vulnerability allows a low-privileged attacker to inject and execute arbitrary code within the application context without needing special access or user interaction, potentially compromising the server and any data it handles.
Technical details
ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code (CWE-95 / Eval Injection) vulnerability. The vulnerability allows a low-privileged attacker to inject malicious directives into code that is dynamically evaluated at runtime, resulting in arbitrary code execution in the context of the current user. The attack requires network access but does not require user interaction or elevated privileges, making it directly exploitable by any attacker with network connectivity to the affected application.
Affected products
- Adobe ColdFusion
Timeline
- 2026-09-08: disclosed