CVE-2026-75995: ColdFusion | Improper Input Validation (CWE-20)
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Systems are exposed if an attacker already has high privileges and can reach the vulnerable component. By default, that component is restricted to an administrative network zone, so exposure depends on access to that zone.
Does exploitation require user interaction?
No. An attacker with high privileges can exploit the issue without user interaction.
What level of impact can successful exploitation have?
Successful exploitation can result in arbitrary code execution in the context of the current user. The stated impact includes high confidentiality, integrity, and availability consequences, with changed scope.