Key points
- The National Vulnerability Database rates CVE-2026-75994 as critical with a CVSS score of 9.6.
- Affected versions include Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13.
- Exploitation does not require user interaction, though the vulnerable component defaults to an administrative zone.
A critical vulnerability in Adobe ColdFusion allows attackers to execute arbitrary code on affected servers without needing user interaction. According to the National Vulnerability Database, this flaw, tracked as CVE-2026-75994, stems from an incorrect authorization mechanism. The issue permits remote code execution in the context of the current user, potentially granting control over the compromised application server if successful exploitation occurs.
By the numbers
- CVSS 9.6: The severity rating assigned by the National Vulnerability Database, indicating a critical risk level.
- CWE-863: The Common Weakness Enumeration identifier for the incorrect authorization weakness underlying this vulnerability.
- 2025.0.13: The latest version of Adobe ColdFusion 2025 listed as affected by this specific security flaw.
What the figures mean
The high severity score reflects the ease with which an attacker can exploit this authorization bypass. Because the vulnerability allows arbitrary code execution, the potential impact is severe for any organization running unpatched versions. The National Vulnerability Database notes that the vulnerable component is restricted to an administrative network zone by default. This architectural constraint may limit exposure to internal networks, but it does not eliminate the risk for attackers who have already breached perimeter defenses or gained network access to administrative subnets.
What to watch
Security teams should monitor for unauthorized administrative access patterns on ColdFusion servers. The National Vulnerability Database specifies that exploitation does not require user interaction, meaning automated scanners or targeted attacks can trigger the flaw. Organizations running Adobe ColdFusion 2023 or 2025 must verify their current version against the affected ranges. Since the source material does not confirm a fix, immediate inventory checks are essential to determine exposure.
Infection and persistence in general
Analysts investigating this type of authorization bypass typically examine server logs for anomalous administrative requests originating from unexpected IP addresses. Malware delivered via such exploits often establishes persistence by creating new user accounts or modifying scheduled tasks. Teams usually check for unexpected outbound connections to command-and-control servers. Investigators also look for signs of lateral movement, as attackers often use initial access to probe for other vulnerable systems within the administrative network zone.
What to do and how to stay safe: Adobe ColdFusion
- Audit network segmentation to ensure the administrative zone is strictly isolated from general user traffic.
- Monitor server logs for unusual administrative commands or code execution attempts that lack valid authentication tokens.
- Verify current ColdFusion versions against the affected lists and prepare to apply updates once the vendor provides them.
- Restrict inbound traffic to administrative interfaces to known, trusted IP addresses to reduce the attack surface.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Adobe ColdFusion are affected by CVE-2026-75994?
Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13 are affected.
Does exploiting this vulnerability require user interaction?
No, the National Vulnerability Database states that exploitation does not require user interaction.
What is the severity rating for CVE-2026-75994?
The vulnerability is rated as critical with a CVSS score of 9.6.
