CVE-2026-75746

CVE-2026-75746 is an SQL injection flaw (CWE-89) in Adobe ColdFusion that can escalate to arbitrary code execution in the context of the current user. A remote attacker who has already obtained high-privileged access, such as administrative-level credentials, can trigger the flaw over the network without any user interaction, and the changed scope means the impact extends beyond the vulnerable component's normal security boundary. Successful exploitation carries high-impact confidentiality, integrity, and availability consequences for the server. Organizations running Adobe ColdFusion, particularly internet-facing instances or deployments where privileged access is reachable by less-trusted users, are in scope. As of this analysis there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates roughly a 1.1% chance of exploitation within 30 days, indicating no known exploitation to date.

What to do: Apply the ColdFusion security update issued in Adobe's recent batch (which patched over 170 vulnerabilities) and confirm your installed build matches the fixed release listed in the Adobe advisory. Because the flaw requires high-privileged access, restrict administrative access to ColdFusion, rotate and harden privileged credentials, review logs for unexpected SQL activity from privileged accounts, and limit internet exposure of the server. No public PoC or KEV listing exists yet, but prioritize patching internet-facing ColdFusion instances given the critical base score.