CVE-2026-75994
Received Received - Intake

Incorrect Authorization in Adobe ColdFusion Allows Code Execution

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Adobe Systems Incorporated

Description
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-75994
EUVD
EUVD-2026-100515

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Adobe ColdFusion 2025 0
Adobe ColdFusion 2023 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ColdFusion has an Incorrect Authorization vulnerability allowing arbitrary code execution with the privileges of the current user. Attackers can exploit this without user interaction. The vulnerable component is restricted to an administrative network zone by default.

Impact Analysis

An attacker could execute arbitrary code on your system, potentially gaining full control. This could lead to data theft, system compromise, or further network infiltration if the attacker exploits the administrative access.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health information privacy). Non-compliance may result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Apply the latest security patches from Adobe for ColdFusion 2025 or 2023 immediately. Restrict administrative access to trusted networks only. Monitor for unauthorized code execution attempts in administrative zones.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75994. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart