Adobe ColdFusion Faces Critical Auth Flaw Allowing Remote Code Execution
A severe authorization error in Adobe ColdFusion allows attackers to run arbitrary code without user interaction, affecting versions up to 2025.0.13 and 2023.0.25.
Key points
- CVE-2026-75994 carries a CVSS score of 9.6, rated critical by the National Vulnerability Database.
- The flaw enables arbitrary code execution in the context of the current user without requiring interaction.
- Affected products include Adobe ColdFusion 2025 up to version 0.13 and ColdFusion 2023 up to version 0.25.
Adobe ColdFusion contains a critical authorization vulnerability that permits unauthorized remote code execution. The National Vulnerability Database has assigned the issue CVE-2026-75994 and rated it with a CVSS score of 9.6, indicating severe risk to affected systems.
At a glance
- CVE
- CVE-2026-75994
- Product
- Adobe ColdFusion 2025
- CVSS
- 9.6 Critical
- Weakness
- incorrect authorization
- Exploited
- No known exploitation
An attacker can exploit this incorrect authorization flaw to execute arbitrary code within the context of the current user. According to the NVD record, exploitation does not require any user interaction, making the vulnerability highly dangerous for exposed administrative interfaces.
Technical Context and Scope
The vulnerability stems from an incorrect authorization mechanism classified under CWE-863. This weakness allows an attacker to bypass security controls and perform actions they should not be permitted to execute. The scope of the vulnerability is noted as changed in the advisory.
The vulnerable component is restricted to an administrative network zone by default. This configuration detail suggests that the attack surface may be narrower than public-facing endpoints, but any misconfigured or exposed administrative interface remains at significant risk.
Affected Versions and Products
The advisory specifically identifies Adobe ColdFusion 2025 versions up to 2025.0.13 as affected by this issue. Organizations running these releases should verify their current version against the list of vulnerable builds to determine exposure.
Adobe ColdFusion 2023 versions up to 2023.0.25 are also listed as vulnerable in the NVD record. Users of these older major versions face the same arbitrary code execution risks if they have not applied any subsequent patches that might address this specific authorization gap.
What should you do?
Security teams should immediately inventory their ColdFusion installations to identify any systems running the affected versions. Since no patch or fix has been confirmed yet in the source material, organizations must focus on containment and monitoring until an official update is released.
What to do and how to stay safe: Adobe ColdFusion
- Inventory all Adobe ColdFusion servers to identify versions 2025 up to 2025.0.13 and 2023 up to 2023.0.25.
- Restrict network access to ColdFusion administrative interfaces to trusted IP addresses only, leveraging the default administrative zone restriction.
- Monitor server logs and network traffic for unusual activity or unauthorized code execution attempts on administrative endpoints.
- Prepare to apply updates immediately once the vendor releases a patch or security bulletin addressing CVE-2026-75994.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-75994?
The National Vulnerability Database rates CVE-2026-75994 with a CVSS score of 9.6, which is classified as critical.
Does exploiting this vulnerability require user interaction?
No, exploitation of this issue does not require user interaction, allowing attackers to execute code remotely without triggering a user action.
Which Adobe ColdFusion versions are affected by this flaw?
Adobe ColdFusion 2025 up to version 2025.0.13 and Adobe ColdFusion 2023 up to version 2023.0.25 are affected by this authorization vulnerability.
