VDB
GCVE-110-NCSC-2026-435
GCVE-110-NCSC-2026-435
Advisory PublishedCVSS 9.3/10
ColdFusion contains a Server-Side Request Forgery (SSRF) vulnerability that enables privilege escalation without user interaction, with an altered attack scope.
Weaknesses (CWE)
CWE-918Server-Side Request Forgery (SSRF)CWE-863Incorrect AuthorizationCWE-434Unrestricted Upload of File with Dangerous TypeCWE-94Improper Control of Generation of Code ('Code Injection')CWE-611Improper Restriction of XML External Entity ReferenceCWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Risk Scores
CVSS 3.1
9.3/10
Critical · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Adobe | vers:unknown/* | — | — |
Aliases
CVE-2026-105897CVE-2026-105898CVE-2026-105899CVE-2026-105900CVE-2026-105901CVE-2026-105903CVE-2026-105994CVE-2026-106089CVE-2026-106090CVE-2026-106612CVE-2026-106613CVE-2026-106614CVE-2026-106615CVE-2026-106616CVE-2026-106617CVE-2026-106618CVE-2026-106619CVE-2026-106620CVE-2026-106621CVE-2026-106622CVE-2026-106623CVE-2026-106624CVE-2026-34633CVE-2026-34634CVE-2026-48378CVE-2026-71385CVE-2026-75748CVE-2026-75994CVE-2026-75995CVE-2026-75996CVE-2026-76001CVE-2026-90530
References
Browse GCVE Records
5,487 records in the GCVE database · Updated October 16, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.