CVE-2026-76190: ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
Published Sep 8, 2026
·Updated
ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
1 affected component
Adobe ColdFusion
Event History
Sep 8, 2026
CVE Published
via MITRE·07:37 PM
Data Sourced
via MITRE·07:37 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Can this be exploited remotely without credentials or user interaction?
Yes. The vector is network-based, attack complexity is low, privileges are not required, and no user interaction is required.
2
What access could successful exploitation provide?
An attacker could execute arbitrary code in the context of the current user. The vulnerability has a changed scope and high integrity impact, while confidentiality and availability impacts are listed as none.