CVE-2026-34635: Adobe ColdFusion Auth Bypass Vulnerability

CVE-2026-34635 Overview

Adobe ColdFusion contains a Use of Hard-coded Cryptographic Key vulnerability [CWE-321] that enables a security feature bypass. A low-privileged local attacker can leverage the hard-coded key to bypass cryptographic protections and gain unauthorized read and write access to protected resources. Exploitation does not require user interaction and results in a scope change, meaning the impact extends beyond the initially vulnerable component. The flaw affects Adobe ColdFusion 2023 (base through Update 22) and Adobe ColdFusion 2025 (base through Update 11). Adobe published a security advisory (APSB26-90) addressing the issue.

Critical Impact
A low-privileged local attacker can bypass cryptographic security controls in Adobe ColdFusion to read and modify protected data, with impact crossing security scope boundaries.

Affected Products

Adobe ColdFusion 2023 (base release through Update 22)
Adobe ColdFusion 2025 (base release through Update 11)
Deployments relying on ColdFusion's built-in cryptographic functions for access control

Discovery Timeline

2026-08-11 - CVE-2026-34635 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-34635

Vulnerability Analysis

The vulnerability stems from Adobe ColdFusion shipping with a cryptographic key embedded directly in the product distribution. Because the key is static and identical across installations, any attacker who obtains or reverse-engineers it can produce valid cryptographic artifacts that ColdFusion will accept as authentic. This defeats the confidentiality and integrity guarantees the affected security feature is meant to provide.

Exploitation requires only local access with low privileges. No user interaction is needed. The scope change indicator signals that a successful attack impacts resources beyond the vulnerable component itself, such as adjacent applications, sessions, or data owned by higher-privileged principals on the same host.

The flaw enables both unauthorized reads and unauthorized writes. In practical terms, an attacker can forge signed tokens, decrypt sensitive stored values, or tamper with protected configuration and session data that ColdFusion trusts based on the hard-coded key.

Root Cause

The root cause is classified under [CWE-321]: Use of Hard-Coded Cryptographic Key. Rather than generating installation-specific keys during setup or deriving keys from an operator-supplied secret, the affected ColdFusion component uses a constant key baked into the shipped binaries or configuration. Once the key is extracted from any copy of ColdFusion, it is compromised for every deployment using the same version.

Attack Vector

The attack vector is local. An authenticated low-privileged user on the ColdFusion host, or on a system that can reach the affected component through a local interface, can invoke functionality that validates or produces data using the hard-coded key. The attacker uses knowledge of the key to craft cryptographic material that ColdFusion accepts as legitimate, bypassing the intended security check and gaining read/write access to protected assets. No verified public exploit or proof-of-concept has been published at the time of this writing.

Detection Methods for CVE-2026-34635

Indicators of Compromise

Unexpected access to encrypted ColdFusion configuration files, session stores, or data source credentials by low-privileged local accounts
Cryptographic operations succeeding for identities that should not possess the required key material
Modifications to ColdFusion Administrator settings, scheduled tasks, or datasource definitions without a corresponding administrative session
New or altered .cfm and .cfc files in web roots following local logon activity by non-administrative accounts

Detection Strategies

Inventory ColdFusion installations and compare installed update levels against the fixed versions listed in Adobe advisory APSB26-90
Monitor process execution on ColdFusion servers for unusual invocations of cfusion binaries or Java processes by non-service accounts
Baseline and alert on changes to ColdFusion configuration files under cfusion/lib/ and cfusion/wwwroot/WEB-INF/
Correlate local logon events with subsequent access to ColdFusion administrative endpoints or file system paths

Monitoring Recommendations

Enable file integrity monitoring on ColdFusion installation directories and web application roots
Forward ColdFusion application and administrator logs to a centralized logging platform for retention and analysis
Track privilege usage on ColdFusion hosts and alert on low-privileged accounts touching cryptographic material or protected configuration
Review authentication logs on ColdFusion servers for local logons from unexpected users or service accounts

How to Mitigate CVE-2026-34635

Immediate Actions Required

Apply the Adobe ColdFusion security update referenced in Adobe Security Bulletin APSB26-90 to all affected 2023 and 2025 installations
Restrict local logon rights on ColdFusion servers to only administrative and required service accounts
Rotate any secrets, tokens, or credentials that may have been protected by the affected cryptographic feature after patching
Audit ColdFusion Administrator accounts, scheduled tasks, and datasources for unauthorized changes

Patch Information

Adobe has released fixed builds for ColdFusion 2023 and ColdFusion 2025. Refer to Adobe Security Bulletin APSB26-90 for the specific update numbers, download locations, and installation instructions. Deployments running ColdFusion 2023 Update 22 or earlier, and ColdFusion 2025 Update 11 or earlier, are affected and require the vendor-supplied patch.

Workarounds

Limit interactive and remote local access to ColdFusion hosts to trusted administrators only
Segment ColdFusion servers from general-purpose workstations and multi-tenant systems to reduce local attack surface
Enforce least privilege on the operating system account running the ColdFusion service and on any co-located applications
Enable and review host-based logging so that any local access to ColdFusion resources is auditable

bash

# Example: restrict local logon on a Windows ColdFusion host to a defined group
# (adjust group names to match your environment; apply via Group Policy in production)
ntrights +r SeInteractiveLogonRight -u "ColdFusion Admins"
ntrights -r SeInteractiveLogonRight -u "Users"

# Example: verify installed ColdFusion update level before and after patching
type "C:\ColdFusion2025\cfusion\lib\version.properties"