CVE-2026-75995

Undergoing Analysis Undergoing Analysis - In Progress

Improper Input Validation in Adobe ColdFusion Leads to Arbitrary Code Execution

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: Adobe Systems Incorporated

Description

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-75995

EUVD

EUVD-2026-100508

Affected Vendors & Products

Vendor	Product	Version / Range
Adobe	ColdFusion	2025 0
Adobe	ColdFusion	2023 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability in Adobe ColdFusion is due to improper input validation, allowing arbitrary code execution with the privileges of the current user. It requires high privileges to exploit but does not need user interaction. The vulnerable component is typically restricted to an administrative network zone by default.

Impact Analysis

An attacker with high privileges could exploit this to run malicious code on your system, potentially leading to data breaches, unauthorized access, or system compromise. Since exploitation does not require user interaction, the risk is elevated if the vulnerable component is exposed.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (healthcare data privacy). Non-compliance may result in legal penalties, fines, or reputational damage due to compromised sensitive information.

Mitigation Strategies

Apply the latest security patches from Adobe for ColdFusion 2025 or 2023 immediately. Restrict administrative access to trusted networks only. Monitor for unusual administrative activities or code execution attempts.

Hi! I’m here to help you understand CVE-2026-75995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70