CVE-2026-75994 is a critical (CVSS 9.6) incorrect authorization vulnerability in Adobe ColdFusion 2025 and 2023 that can let an unauthenticated attacker on an adjacent network execute arbitrary code without user interaction.
What Is It
Adobe reported CVE-2026-75994 as an Incorrect Authorization weakness (CWE-863) in ColdFusion. According to the NVD record, exploitation "could result in arbitrary code execution in the context of the current user." The flaw was published to NVD on October 13, 2026, and NVD has not yet analyzed it (status: Received).
Adobe gave it a CVSS 3.1 base score of 9.6 (Critical), with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H:
- Attack vector: Adjacent network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, integrity, and availability
Why It Matters
The flaw needs no authentication and no user interaction, and its attack complexity is low. Together, these ratings suggest that an attacker who can reach the vulnerable component may not face many barriers to exploiting it. Because the scope is changed, a successful attack can affect resources beyond the vulnerable component itself.
Adobe notes one limit: by default, the vulnerable component is only reachable from an administrative network zone. This is consistent with the adjacent-network attack vector. ColdFusion deployments that expose administrative interfaces more broadly than the default may face more risk.
Exploitation status: The sources cited here do not confirm whether CVE-2026-75994 has been exploited. Check the CISA Known Exploited Vulnerabilities (KEV) catalog and Adobe's bulletin for current status.
What's Vulnerable
| Product | Affected Versions | First Unaffected Version |
|---|---|---|
| Adobe ColdFusion 2025 | 2025.0.13 and earlier | 2025.0.14 |
| Adobe ColdFusion 2023 | 2023.0.25 and earlier | 2023.0.26 |
Patch Status
Adobe has addressed the issue in security bulletin APSB26-144. Based on the vendor's version data, the fixed releases are:
- ColdFusion 2025: 2025.0.14
- ColdFusion 2023: 2023.0.26
Required action: Upgrade affected ColdFusion 2025 and 2023 instances to the fixed versions above. Follow the guidance in Adobe's APSB26-144 bulletin. Until patching is complete, check that ColdFusion administrative components are still limited to the administrative network zone, as they are by default.