CVE-2026-12257: Mura CMS Remote Code Execution Vulnerability

CVE-2026-12257 Overview

CVE-2026-12257 is a critical remote code execution (RCE) vulnerability affecting Mura CMS versions prior to 10.0.712. The flaw resides in the /index.cfm/_api/json/v1/default endpoint, where the method parameter in POST requests is not validated or sanitized before being processed by the ColdFusion engine. Unauthenticated remote attackers can inject arbitrary ColdFusion Markup Language (CFML) expressions and instantiate Java objects, leading to full system compromise. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can execute arbitrary CFML code and instantiate Java objects on the underlying server, resulting in full confidentiality, integrity, and availability loss.

Affected Products

Mura CMS versions prior to 10.0.712
Deployments running on Adobe ColdFusion or Lucee application servers
Web applications exposing the /index.cfm/_api/json/v1/default endpoint

Discovery Timeline

2026-07-13 - CVE-2026-12257 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-12257

Vulnerability Analysis

The vulnerability originates in the Mura CMS JSON API dispatcher at /index.cfm/_api/json/v1/default. The endpoint accepts a method parameter in POST requests and passes it directly to the ColdFusion engine for evaluation. Because the value undergoes no allow-list validation or input sanitization, an attacker controls the code path that ColdFusion executes.

Attackers can supply CFML expressions in place of legitimate method names. The ColdFusion runtime interprets these expressions and executes them within the application context. This includes instantiating arbitrary Java objects through CFML's createObject semantics, which grants the attacker access to the full Java class library available to the application server.

The result is unauthenticated remote code execution on the underlying host. According to the INCIBE advisory, successful exploitation compromises the confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause is improper control of code generation [CWE-94]. Mura CMS treats the client-supplied method value as trusted input for dynamic dispatch. Without an allow-list of permitted method names or strict type validation, the ColdFusion engine evaluates attacker-supplied strings as executable CFML.

Attack Vector

Exploitation requires only network access to the vulnerable endpoint. The attacker sends a crafted POST request to /index.cfm/_api/json/v1/default with a malicious payload in the method parameter. No authentication, user interaction, or elevated privileges are required. Technical details are documented in the INCIBE Remote Code Execution Notice.

Detection Methods for CVE-2026-12257

Indicators of Compromise

POST requests to /index.cfm/_api/json/v1/default containing CFML syntax such as createObject, <cfexecute>, or Runtime.getRuntime in the method parameter
Unexpected child processes spawned by the ColdFusion or Lucee application server (java.exe, cfusion.exe, or tomcat processes launching shells)
New or modified .cfm and .cfc files in webroot directories outside normal deployment activity
Outbound network connections from the ColdFusion process to unfamiliar IP addresses

Detection Strategies

Inspect web server access logs for POST requests to the vulnerable endpoint with abnormally long or non-alphanumeric method values
Deploy web application firewall (WAF) rules that block ColdFusion tag syntax and Java class references in JSON API parameters
Correlate ColdFusion process activity with file system and network telemetry to identify anomalous execution chains

Monitoring Recommendations

Enable verbose logging on the Mura CMS API dispatcher and forward logs to a centralized SIEM for retention and analysis
Baseline normal method parameter values used by legitimate clients and alert on deviations
Monitor for creation of webshells or scheduled tasks originating from the web application user account

How to Mitigate CVE-2026-12257

Immediate Actions Required

Upgrade Mura CMS to version 10.0.712 or later without delay
Restrict network access to the /index.cfm/_api/json/v1/default endpoint using firewall or reverse proxy rules where feasible
Audit web server and application logs for prior exploitation attempts against the vulnerable endpoint
Rotate any credentials, API keys, or secrets accessible from the ColdFusion application context if compromise is suspected

Patch Information

Mura Software addressed the vulnerability in Mura CMS version 10.0.712. Administrators should apply the upgrade through official Mura distribution channels. Refer to the INCIBE Remote Code Execution Notice for advisory details.

Workarounds

Deploy WAF signatures that reject requests containing CFML tags or Java class instantiation patterns in the method parameter
Enforce IP allow-listing on the JSON API endpoint to restrict access to trusted management networks
Run the ColdFusion or Lucee service under a least-privileged account to limit the impact of successful exploitation

bash

# Example WAF rule (ModSecurity) blocking CFML injection in the method parameter
SecRule REQUEST_URI "@beginsWith /index.cfm/_api/json/v1/default" \
    "phase:2,deny,status:403,id:1002026,\
    msg:'CVE-2026-12257 Mura CMS CFML injection attempt',\
    chain"
  SecRule ARGS:method "@rx (?i)(createObject|cfexecute|Runtime\.|java\.lang)" \
    "t:none,t:urlDecodeUni"