Adobe has disclosed a critical SQL injection vulnerability in ColdFusion 2023 and ColdFusion 2025 that can lead to arbitrary code execution in the context of the current user.
What Is It
CVE-2026-75746 is an improper neutralization of special elements used in an SQL command; a classic SQL injection weakness, tracked as CWE-89. Adobe's advisory states the flaw "could result in arbitrary code execution in the context of the current user." An attacker with high privileges can exploit it, and exploitation does not require user interaction.
The vulnerability carries a CVSS 3.1 base score of 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. It was published on 2026-09-08 by Adobe's PSIRT and currently sits in "Awaiting Analysis" status at NVD.
Why It Matters
The score is driven by two things: full compromise of confidentiality, integrity, and availability, and a changed scope. Scope change means the impact reaches beyond the vulnerable component itself; SQL injection landing as code execution is exactly that escalation path.
The mitigating factor is the privilege requirement. This is not an unauthenticated pre-auth bug; the attacker needs high privileges on the target. But the attack vector is NETWORK with LOW complexity and no user interaction required, so an attacker who has already obtained privileged access can reach code execution over the network with little friction.
CVE-2026-75746 does not appear in CISA's Known Exploited Vulnerabilities catalog, and neither Adobe's bulletin nor the NVD record cites evidence of active exploitation as of publication.
What's Vulnerable
Per Adobe's affected-product data:
- ColdFusion 2025: update 12 and earlier are affected. Update 13 is unaffected.
- ColdFusion 2023: update 23 and earlier are affected. Update 24 is unaffected.
No CPE entries have been assigned yet, consistent with the record's pending NVD analysis.
Patch Status
Fixed versions are available. Adobe published the fix in security bulletin APSB26-119. Administrators should move ColdFusion 2025 to update 13 and ColdFusion 2023 to update 24. Adobe's bulletin lists no workaround or mitigation; patching is the documented remediation.
Sources
- Adobe Security Bulletin APSB26-119; https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html
- NVD, CVE-2026-75746, https://nvd.nist.gov/vuln/detail/CVE-2026-75746
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog