CVE-2026-75998: ColdFusion | Improper Access Control (CWE-284)
Published Sep 8, 2026
·Updated
ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.
Affected Software
1 affected component
Adobe ColdFusion
Event History
Sep 8, 2026
CVE Published
via MITRE·07:37 PM
Data Sourced
via MITRE·07:37 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Can this be exploited remotely without credentials or user interaction?
Yes. The vector is network-based, requires low attack complexity, and requires neither privileges nor user interaction.
2
What is the likely impact if exploitation succeeds?
An attacker may be able to read arbitrary files and directories outside the intended access scope, potentially exposing sensitive information. The stated impact is high confidentiality impact, with no integrity or availability impact indicated.