CVE-2026-75994: ColdFusion RCE Vulnerability

CVE-2026-75994 Overview

Adobe ColdFusion contains an Incorrect Authorization vulnerability [CWE-863] that allows arbitrary code execution in the context of the current user. The flaw permits an unauthenticated attacker on an adjacent network to bypass authorization checks and execute code on the affected system. The vulnerable component is restricted to an administrative network zone by default, and exploitation requires no user interaction. The scope is changed, meaning successful exploitation can impact resources beyond the vulnerable component.

Critical Impact

Attackers with adjacent network access can execute arbitrary code on ColdFusion servers without authentication or user interaction, potentially compromising confidentiality, integrity, and availability of connected systems.

Affected Products

• Adobe ColdFusion (versions specified in the Adobe advisory APSB26-144)
• ColdFusion deployments exposing administrative components to adjacent networks
• Systems where default administrative network zone restrictions have been modified

Discovery Timeline

• 2026-10-13 - CVE-2026-75994 published to the National Vulnerability Database
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-75994

Vulnerability Analysis

The vulnerability is classified as Incorrect Authorization [CWE-863], where the application performs an authorization check but does not correctly enforce it. An attacker reaching the administrative component over an adjacent network can bypass the intended access control and invoke privileged functionality. Successful exploitation results in arbitrary code execution in the context of the current user running the ColdFusion process.

Because the scope is changed, code executed through this flaw can affect resources managed by other security authorities. In practice this means a compromised ColdFusion instance can be leveraged to pivot into back-end databases, file shares, or integrated application components.

Root Cause

The root cause is an authorization logic failure in a ColdFusion component that is reachable within the administrative network zone. The application does not adequately verify that the requesting principal is permitted to execute the targeted operation. See the Adobe ColdFusion Security Advisory APSB26-144 for vendor-specific technical details.

Attack Vector

The attack vector is adjacent network, meaning the attacker must be on the same logical network segment, broadcast domain, or administrative VPN as the ColdFusion server. No credentials and no user interaction are required. Once reachable, the attacker sends a crafted request to the vulnerable administrative endpoint, which processes the request without proper authorization and executes attacker-supplied code.

No verified public proof-of-concept code is available at the time of publication. Technical specifics of the vulnerable endpoint are described in the Adobe advisory.

Detection Methods for CVE-2026-75994

Indicators of Compromise

• Unexpected child processes spawned by the ColdFusion Java process (coldfusion.exe, jrun.exe, or the JVM running CFML)
• Unusual outbound network connections from ColdFusion servers to internet hosts
• New or modified .cfm, .cfc, or .jsp files in web-accessible directories
• Unauthorized requests to ColdFusion administrator paths such as /CFIDE/administrator/ from adjacent network segments

Detection Strategies

• Baseline the normal process tree of the ColdFusion service and alert on deviations such as shell, scripting, or LOLBin child processes
• Inspect ColdFusion application and HTTP server logs for anomalous POST requests to administrative endpoints without preceding authenticated sessions
• Monitor file integrity on ColdFusion web roots and CFIDE directories for unauthorized changes

Monitoring Recommendations

• Forward ColdFusion access logs, application logs, and host EDR telemetry into a centralized analytics platform for correlation
• Alert on network connections to ColdFusion administrative ports from hosts outside the designated management subnet
• Track authentication and authorization failures that precede successful privileged operations

How to Mitigate CVE-2026-75994

Immediate Actions Required

• Apply the Adobe security update referenced in APSB26-144 to all affected ColdFusion instances
• Verify that ColdFusion administrative components remain restricted to a dedicated administrative network zone
• Audit recent access to administrative endpoints and investigate any requests originating from unexpected sources
• Rotate credentials, API keys, and secrets stored on or accessible to the ColdFusion server if compromise is suspected

Patch Information

Adobe has released a security update addressing CVE-2026-75994. Refer to the Adobe ColdFusion Security Advisory APSB26-144 for the specific fixed versions and installation guidance. Administrators should apply updates per Adobe's priority rating schedule.

Workarounds

• Enforce strict network segmentation so that the ColdFusion administrator interface is only reachable from a hardened management network
• Restrict access to /CFIDE/administrator/ and related administrative paths at the web server or reverse proxy using IP allowlists
• Run the ColdFusion service under a least-privilege account to limit the impact of code execution in the current user context
• Disable or remove unused ColdFusion components and sample applications that expand the attack surface

# Example: restrict ColdFusion admin paths to a management subnet in nginx
location ~* ^/CFIDE/(administrator|adminapi|componentutils)/ {
    allow 10.10.50.0/24;   # management subnet
    deny  all;
    proxy_pass http://coldfusion_backend;
}