Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-75994: Adobe ColdFusion may let attackers run code
CVE-2026-75994 · published today
Summary
Adobe ColdFusion versions 2023 and 2025 contain a flaw that lets an attacker run any program on the server without needing a user to click anything. The issue is limited to a special admin network area, but if reached it can give the attacker the same rights as the logged‑in user. Apply the latest security updates from Adobe as soon as possible to close the gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| adobe | coldfusion 2025 | <= 2025.0.13 |
| adobe | coldfusion 2023 | <= 2023.0.25 |
Original advisory text
ColdFusion | Incorrect Authorization (CWE-863)
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-863Incorrect Authorization
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta