Executive brief
Adobe ColdFusion is a web application development platform used to build dynamic websites and enterprise applications. A SQL injection vulnerability in ColdFusion allows attackers with elevated privileges to inject malicious SQL commands that can lead to arbitrary code execution on the affected server, potentially compromising application data and operations.
Technical details
This is a SQL injection vulnerability (CWE-89) in Adobe ColdFusion that fails to properly neutralize special characters in SQL commands. An attacker with high privileges can craft malicious SQL input to execute arbitrary code in the context of the application user. The vulnerability does not require user interaction and changes the security scope of the affected component. The attack vector is network-based, with exploitation possible from an authenticated attacker with elevated permissions.
Affected products
- Adobe ColdFusion
Timeline
- 2026-09-08: disclosed