CVE-2026-25652

HighCVSS 7.8/10Last modified Aug 28, 2026

Description

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Adobe	ColdFusion 2025	<= 2025.0.11
Adobe	ColdFusion 2023	<= 2023.0.22

References

https://helpx.adobe.com/security/products/coldfusion/apsb26-90.htmlVendor Advisory

Timeline

Published: Aug 11, 2026
Last modified: Aug 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-256548.8A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization wh CVE-2026-256557.8A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2). The affected application permits improper modification of a conf CVE-2026-256567.8A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All versions < V2.15.2.1). The CVE-2026-256576.5Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Syntactically Invalid Structure (CWE-228) vulnerab CVE-2026-256586.5Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an at CVE-2026-256596.5Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an at CVE-2026-25667.2A security vulnerability has been detected in Wavlink WL-NU516U1 up to 130/260. This affects the function sub_406194 of the file /cgi-bin/ad CVE-2026-256609.8CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypas CVE-2026-256677.5ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumpt CVE-2026-25677.2A vulnerability was detected in Wavlink WL-NU516U1 20251208. This vulnerability affects the function sub_401218 of the file /cgi-bin/nas.cgi CVE-2026-256737.5An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.CVE-2026-256743.7An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based