AdobeCVE-2026-34635
Adobe ColdFusion: security feature bypass
High8.4CVE-2026-34635 · Published Aug 11, 2026 · updated Aug 28, 2026
is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| ColdFusion 2023 Product | <= 2023.0.22 | No fix yet |
| ColdFusion 2025 Product | <= 2025.0.11 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-321
More Adobe advisories
All Adobe| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 11 | Adobe Campaign Classic: improper authorization | Critical10.0 | No fix yet |
| Aug 11 | Adobe Commerce: improper authorization | Critical9.1 | No fix yet |
| Aug 11 | Adobe Lightroom Classic: improper authorization | High7.7 | No fix yet |
| Aug 11 | Adobe Lightroom Classic: path traversal | High8.6 | No fix yet |
| Aug 11 | Adobe Commerce: cross-site scripting | High8.7 | No fix yet |
| Aug 11 | Adobe Commerce: cross-site scripting | High7.7 | No fix yet |