Key points
- CVE-2026-75994 carries a CVSS score of 9.6, rated Critical by the NVD.
- The flaw allows arbitrary code execution in the context of the current user.
- Affected versions include Adobe ColdFusion 2025 up to 0.13 and 2023 up to 0.25.
Adobe ColdFusion 2025 and 2023 are vulnerable to a critical authorization flaw that allows remote code execution. The National Vulnerability Database assigned CVE-2026-75994 a CVSS score of 9.6. Versions of ColdFusion 2025 up to 2025.0.13 and ColdFusion 2023 up to 2023.0.25 are affected. The vulnerability stems from incorrect authorization controls within the application.
In plain English
An attacker can exploit this flaw to run arbitrary code on the server. The code executes in the context of the current user. Exploitation does not require any interaction from a user or administrator. The vulnerable component is restricted to an administrative network zone by default. This means the flaw is not exposed to the public internet by default configuration.
The background
The issue is classified under CWE-863, which relates to incorrect authorization. The NVD record states that the scope of the vulnerability is changed. This indicates that the attacker gains access to different resources than the victim. The vulnerability allows an attacker to execute arbitrary code. The default placement in an administrative zone reduces the initial attack surface.
What changes now
Security teams must verify their ColdFusion installations against the affected version list. Organizations running ColdFusion 2025.0.13 or earlier must plan for updates. Those on ColdFusion 2023.0.25 or earlier face the same risk. The NVD record does not mention a specific patch release date or version. Teams should monitor vendor communications for remediation guidance.
Who needs to act first
Teams should prioritize systems exposed to internal administrative networks. Check whether your ColdFusion instances are accessible beyond the default administrative zone. If exposure is wider, the risk increases significantly. Prepare a maintenance window for testing updates. Back up configurations and data before applying any changes. Verify that network segmentation controls are effective. Monitor logs for unusual activity during the assessment period.
What to do and how to stay safe: Adobe ColdFusion
- Inventory all ColdFusion servers and identify installed versions to confirm exposure.
- Restrict network access to the administrative zone to limit potential attackers.
- Monitor server logs for unauthorized code execution attempts or unusual behavior.
- Wait for the vendor to release a confirmed fix before applying updates.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ColdFusion versions are affected by CVE-2026-75994?
Adobe ColdFusion 2025 up to 2025.0.13 and Adobe ColdFusion 2023 up to 2023.0.25 are affected.
Does exploiting this vulnerability require user interaction?
No, exploitation of this issue does not require user interaction according to the NVD.
What is the CVSS score for CVE-2026-75994?
The NVD assigns a CVSS score of 9.6 to this vulnerability.
