Adobe ColdFusion CVE-2026-34619: Quick Look at a Priority 1 Path Traversal Bypass

Introduction

A path traversal flaw in Adobe ColdFusion, disclosed on April 14, 2026, lets authenticated attackers sidestep security restrictions and reach files or directories that should be off limits, with no user interaction required. It scores 7.7 on CVSS and carries a Priority 1 patch rating. The bigger reason to track it is ColdFusion's well-documented history of being weaponized quickly after disclosure, including incidents where threat actors breached U.S. government servers within a narrow window after a 2023 vulnerability became public.

Technical information

Root cause and CWE classification

CVE-2026-34619 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerability exists because ColdFusion fails to properly sanitize or restrict user-controlled path components in certain requests. An authenticated attacker can therefore send requests containing directory traversal sequences (such as ../ or URL-encoded variants) that break out of the intended directory scope and bypass the security features meant to confine file access.

CVSS vector breakdown

The NVD and Adobe assign this vulnerability a CVSS 3.1 base score of 7.7 with the following vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

The metrics break down as follows:

Together, the "Changed" scope and "High" availability impact suggest that exploitation can affect resources beyond the ColdFusion application itself, including dependent services or the underlying server infrastructure.

Conflicting vendor classifications

Security vendors disagree on how to characterize this vulnerability. Adobe and the NVD define CVE-2026-34619 as a path traversal issue leading to a security feature bypass. FortiGuard Labs categorizes it as an Improper Input Validation vulnerability. According to FortiGuard, the flaw stems from insufficient validation of user-supplied input, and successful exploitation via a crafted request could allow a remote attacker to gain unauthorized access to modify variables and execute code.

The difference matters for defenders. If FortiGuard's assessment is accurate, the impact could extend beyond availability disruption to code execution. Until patches are fully deployed and more granular technical details emerge, security teams should assume the worst case.

Attack flow

The available information points to this general exploitation sequence:

1. The attacker authenticates to the ColdFusion server with low-level credentials (the PR:L requirement in the CVSS vector).
2. The attacker crafts an HTTP request with manipulated path components meant to traverse outside the intended directory restrictions. These could include classic ../ sequences, URL-encoded variants (%2e%2e%2f), or other path normalization tricks.
3. The ColdFusion application fails to properly validate or sanitize the path input, so the traversal succeeds.
4. The attacker reaches files or directories outside the application's intended scope and bypasses the security features that should enforce path restrictions.
5. Depending on the exact nature of the bypass (which Adobe has not publicly detailed), this could cause denial-of-service conditions in the ColdFusion instance and possibly in dependent services.

Broader bulletin context

CVE-2026-34619 was released as part of Adobe Security Bulletin APSB26-38, which addresses seven vulnerabilities across ColdFusion 2025 and 2023. The full list shows the overall risk to unpatched environments:

The same bulletin fixes two critical arbitrary code execution flaws (CVSS 9.3 and 8.4), which makes patching more urgent. Administrators who apply the cumulative updates fix all seven issues at once.

Patch information

Adobe addressed CVE-2026-34619 on April 14, 2026, through security bulletin APSB26-38 and gave it Priority 1, its highest urgency rating. Patches shipped at the moment of public disclosure, in line with Adobe's coordinated disclosure process. Jonathan Lein of TrendAI Research reported the flaw and worked with Adobe before publication.

Fixed versions

What the updates include

Besides the path traversal fix, the updates include broader hardening:

• ColdFusion 2025 Update 7 upgrades the embedded Apache Tomcat engine to version 10.1.53.0
• ColdFusion 2023 Update 19 upgrades its Tomcat to version 9.0.116.0

Each update also ships refreshed adminapi, administrator, and CCS packages. That suggests the fix touches server administration and configuration subsystem components, which are the areas most commonly involved in enforcing file path restrictions.

Installation methods

The updates are cumulative, so administrators who are several updates behind can jump straight to the latest one without applying each intermediate hotfix individually. There are two ways to install them:

1. ColdFusion Administrator UI: Package Manager, then Check for Updates
2. Manual offline installation by downloading the respective hotfix JARs:
   • ColdFusion 2025: hotfix-007-331586.jar
   • ColdFusion 2023: hotfix-019-330899.jar

Additional hardening

For JEE deployments, Adobe recommends configuring the jdk.serialFilter JVM flag to block known dangerous deserialization classes, and following the updated ColdFusion Lockdown Guides for each version. Upgrading to either update does not require recreating connectors.

Administrators should account for the Tomcat version changes in change management and run compatibility tests in staging environments. On 64-bit systems, make sure 64-bit ColdFusion installations use a 64-bit Java Runtime Environment.

Detection methods

Network-based IPS detection

FortiGuard Labs has released a dedicated Intrusion Prevention System (IPS) signature for this vulnerability:

• Name: Adobe.ColdFusion.CVE-2026-34619.Improper.Input.Validation
• Signature ID: 60675
• IPS Definition Version: 36.201
• Created: April 14, 2026
• Platforms: Windows, Linux, MacOS

The signature is designed to detect crafted network requests carrying this attack's path traversal patterns and to intercept them at the network layer before they reach the ColdFusion application. Organizations running Fortinet devices should make sure their IPS definitions are updated to version 36.201 or later.

Version-based detection

The simplest approach is asset inventory and version checking. According to both the NVD entry and APSB26-38:

• ColdFusion 2025: Update 6 and earlier are vulnerable
• ColdFusion 2023: Update 18 and earlier are vulnerable

SCAP-compliant vulnerability scanning tools (as recommended by the CIS advisory 2026-034) should flag unpatched instances. Security teams can also check ColdFusion versions directly in the server's administrator panel or installation metadata.

Web application firewall monitoring

Because this is a CWE-22 flaw, existing WAF rules for path traversal can add a layer of detection. Most modern WAFs carry generic path traversal rulesets that would alert on directory traversal sequences in URI paths, query parameters, or POST bodies aimed at ColdFusion endpoints.

Log-based detection

Security teams should review ColdFusion access logs and web server logs (Apache, IIS, or the embedded Tomcat instance) for:

• Requests containing path traversal indicators aimed at ColdFusion endpoints
• Unusual access patterns to files or directories outside the expected ColdFusion web root
• HTTP requests returning unexpected status codes, such as 200 responses for paths that should not be directly accessible

Host-based detection

The CIS advisory (MS-ISAC 2026-034) recommends deploying host-based intrusion detection and prevention solutions on enterprise assets running affected Adobe products, citing CIS Safeguards 13.2 and 13.7. EDR agents or host-based IPS can watch the ColdFusion server for anomalous file access, especially to sensitive files or directories outside the application's intended scope.

At the time of writing, no public YARA, Sigma, Snort, or Suricata rules specifically targeting CVE-2026-34619 have been identified.

Affected systems and versions

The following ColdFusion versions are confirmed vulnerable:

• ColdFusion 2025: Update 6 and all earlier updates
• ColdFusion 2023: Update 18 and all earlier updates

Both product tracks are affected regardless of the underlying operating system (Windows, Linux, MacOS). The vulnerability is reachable over the network and requires only low-level authenticated access, so any ColdFusion instance on a network where an attacker holds valid credentials is at risk. Internet-facing ColdFusion servers are the highest priority for remediation.

Vendor security history

ColdFusion has a documented history of being targeted by advanced threat actors, so the patching timeline for new vulnerabilities matters. In late 2023, CISA issued urgent warnings about CVE-2023-26360, an unauthenticated remote code execution vulnerability in Adobe ColdFusion. Threat actors actively exploited that flaw to gain initial access and breach United States government servers. The FBI and CISA released joint advisories on these attacks, which showed how quickly adversaries weaponize ColdFusion vulnerabilities after disclosure.

No exploitation of CVE-2026-34619 in the wild had been reported as of April 14, 2026. The CVE-2023-26360 precedent shows that the window between a ColdFusion vulnerability disclosure and active exploitation can be extremely narrow. Organizations should treat the Priority 1 rating as a signal to patch within days, not weeks.

References

• Adobe Security Bulletin APSB26-38
• NVD: CVE-2026-34619
• CIS Advisory: Multiple Vulnerabilities in Adobe Products
• FortiGuard IPS Encyclopedia: Signature 60675
• ColdFusion 2025 Update 7 Tech Notes
• ColdFusion 2023 Update 19 Tech Notes
• Zero Day Initiative: April 2026 Security Update Review
• Malwarebytes: Adobe ColdFusion Vulnerability Used in Attacks on Government Servers
• The Hacker News: Hackers Exploited ColdFusion Vulnerability to Breach Government Systems
• SecureLayer7: Unauthenticated RCE in Adobe ColdFusion