CVE-2026-75999

Adobe ColdFusion contains an improper input validation flaw (CWE-20) that allows a low-privileged attacker to execute arbitrary code in the context of the current user. The vulnerable component is restricted to an administrative network zone by default, and exploitation requires user interaction in which a victim opens a malicious file. The CVSS vector (adjacent attack vector, low privileges required, and a scope change) indicates the attack crosses a security boundary, so the attacker needs some access to or foothold in the administrative network zone. Any organization running Adobe ColdFusion whose administrative zone is reachable beyond trusted admin hosts, or whose users in that zone open untrusted files, is potentially affected. There is no known exploitation in the wild, no public proof-of-concept, and EPSS assigns a modest 0.4% probability of exploitation within 30 days.

What to do: Watch Adobe's security bulletin for the patched ColdFusion release and apply the update promptly when published; no fixed versions are named in the data available here. In the interim, verify that the affected administrative network zone component is not reachable from user or internet-facing networks and that hosts in that zone are not used to open untrusted files. Restricting access to ColdFusion administrative endpoints to dedicated admin hosts is the key mitigation.