CVE-2026-76001: ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Adobe ColdFusion deployments are exposed where a low-privileged attacker can interact with the vulnerable functionality. The attacker may be able to use the server to access internal resources and potentially escalate privileges.
What level of access and interaction does exploitation require?
Exploitation requires low-level privileges; it is not an unauthenticated attack. No user interaction is required.
Is exploitation straightforward or reliable?
No. Exploitation has high attack complexity and depends on conditions beyond the attacker’s control.