A critical authorization flaw in Adobe ColdFusion allows attackers to run code without user interaction, affecting 2023 and 2025 versions.
Key points
- CVE-2026-75994 carries a critical CVSS score of 9.6.
- The flaw allows arbitrary code execution in the current user context.
- Adobe ColdFusion 2023 up to 0.25 and 2025 up to 0.13 are affected.
Adobe ColdFusion contains a critical authorization vulnerability that permits remote attackers to execute arbitrary code. This flaw affects widely used versions of the server software and requires no interaction from the user to exploit.
What happened
The National Vulnerability Database lists CVE-2026-75994 as a critical issue with a CVSS score of 9.6. According to the record, the vulnerability stems from incorrect authorization controls within the application. An attacker can exploit this weakness to run arbitrary code in the context of the current user. The affected software includes Adobe ColdFusion 2023 up to version 0.25 and Adobe ColdFusion 2025 up to version 0.13.
Exploitation of this issue does not require user interaction, making it particularly dangerous for exposed systems. The vulnerable component is restricted to an administrative network zone by default. However, if that zone is accessible, the scope of the attack changes significantly. The weakness is categorized under CWE-863, indicating a failure to properly restrict access to sensitive functions.
Why it matters
Authorization flaws occur when software fails to verify if a user has permission to perform an action. In this case, the system allows code execution without proper checks. Remote code execution means an attacker can run commands on the server as if they were a legitimate user. This bypasses standard security boundaries and can lead to full system compromise. Teams usually monitor administrative zones because they hold high-privilege functions.
The fix
- Identify all instances of Adobe ColdFusion 2023 and 2025 on your network.
- Verify the current version numbers against the affected ranges listed above.
- Apply the latest vendor updates once they become available.
- Restrict access to administrative network zones to authorized personnel only.
Why it matters
Administrative interfaces often contain powerful tools that can modify system behavior. When these areas are not properly secured, attackers can leverage them to gain deep access. Incorrect authorization means the software trusts requests it should reject. This type of flaw is dangerous because it bypasses the initial layer of defense. Security teams should treat administrative zones as high-risk areas requiring strict access controls. Regular audits of these zones help ensure that only verified users can interact with sensitive components. This reduces the attack surface and limits the potential impact of any future vulnerabilities.
What to do and how to stay safe: Adobe ColdFusion
- Scan your network for installations of Adobe ColdFusion 2023 and 2025.
- Check version numbers to see if they fall within the affected ranges.
- Monitor vendor announcements for patch releases and apply them promptly.
- Ensure administrative zones are isolated and accessible only to trusted users.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Adobe ColdFusion are affected by CVE-2026-75994?
Adobe ColdFusion 2023 up to 0.25 and Adobe ColdFusion 2025 up to 0.13 are affected.
Does exploiting this vulnerability require user interaction?
No, exploitation of this issue does not require user interaction.
What is the severity rating for CVE-2026-75994?
The vulnerability has a CVSS score of 9.6, which is rated as critical.
