CVE-2026-75996: Adobe ColdFusion DOS Vulnerability

CVE-2026-75996 Overview

Adobe ColdFusion contains an uncontrolled resource consumption vulnerability [CWE-400] that enables remote attackers to trigger a denial-of-service condition. An attacker can exhaust system resources over the network without authentication or user interaction, rendering the ColdFusion application unavailable to legitimate users.

The flaw affects the availability of the service only. Confidentiality and integrity of application data remain intact. Adobe published the fix in security advisory APSB26-144.

Critical Impact
Unauthenticated remote attackers can exhaust ColdFusion server resources and cause application-wide denial of service without any user interaction.

Affected Products

Adobe ColdFusion (versions listed in Adobe advisory APSB26-144)
ColdFusion deployments exposed to untrusted network traffic
ColdFusion server instances handling attacker-reachable request paths

Discovery Timeline

2026-10-13 - CVE-2026-75996 published to the National Vulnerability Database
2026-10-14 - NVD record last modified

Technical Details for CVE-2026-75996

Vulnerability Analysis

The vulnerability is categorized as uncontrolled resource consumption [CWE-400]. ColdFusion fails to enforce adequate limits on resources allocated during request processing. An attacker reaching the service over the network can submit requests that cause the server to consume disproportionate CPU, memory, threads, or file handles.

Sustained exploitation drives the application into a state where it can no longer service legitimate requests. The attack vector is network-based, requires no privileges, and needs no user interaction, making the vulnerability trivially reachable on exposed ColdFusion deployments.

The impact is limited to availability. The flaw does not expose data or allow code execution, but it can take production ColdFusion workloads offline for the duration of the attack.

Root Cause

ColdFusion does not apply sufficient bounds on resource allocation during specific request handling paths. Without rate limits, size caps, or algorithmic complexity controls, repeated or malformed requests force the server to allocate resources until exhaustion. See the Adobe ColdFusion Security Advisory APSB26-144 for the vendor's technical description.

Attack Vector

Exploitation requires only network reachability to the ColdFusion service. An unauthenticated attacker issues crafted requests that force excessive resource allocation. By repeating these requests, or sending a single request that triggers a resource-intensive operation, the attacker degrades or halts application availability.

No authentication, user interaction, or local access is required. Internet-exposed ColdFusion servers are the primary targets.

No public proof-of-concept code or verified exploitation details are available. Refer to Adobe's advisory for authoritative technical references.

Detection Methods for CVE-2026-75996

Indicators of Compromise

Sudden spikes in ColdFusion JVM CPU, heap, or thread utilization without a corresponding increase in legitimate traffic
Repeated requests from a single source to the same ColdFusion endpoint producing unusually long response times
ColdFusion OutOfMemoryError entries or thread-pool saturation messages in coldfusion-out.log and coldfusion-error.log
Application timeouts or 503 Service Unavailable responses correlating with request bursts

Detection Strategies

Monitor ColdFusion JVM metrics (heap, threads, GC frequency) and alert on sustained anomalies
Inspect web server and reverse-proxy logs for high-rate request patterns targeting ColdFusion endpoints
Correlate availability degradation events with request source IPs and User-Agent strings to identify abusive clients

Monitoring Recommendations

Centralize ColdFusion application and JVM logs in a SIEM for availability analytics and alerting
Deploy upstream rate limiting at the WAF or reverse proxy and alert when thresholds are exceeded
Track baseline request volume and response latency per endpoint so resource exhaustion attempts stand out quickly

How to Mitigate CVE-2026-75996

Immediate Actions Required

Apply the Adobe ColdFusion security update referenced in APSB26-144 to all affected instances
Restrict network exposure of ColdFusion administrative and application endpoints to trusted sources where feasible
Enable rate limiting and request size limits at the WAF or reverse proxy fronting ColdFusion

Patch Information

Adobe addressed the vulnerability in the ColdFusion update associated with security bulletin APSB26-144. Administrators should review the advisory for the specific fixed versions corresponding to their ColdFusion release train and schedule immediate deployment. See the Adobe ColdFusion Security Advisory for version-level guidance.

Workarounds

Place ColdFusion behind a WAF configured with per-source rate limiting and request body size caps
Tune JVM thread pool, request timeout, and connection limits to fail fast under abusive load
Block or throttle requests from source IPs exhibiting anomalous request rates against ColdFusion endpoints

bash

# Example nginx reverse-proxy rate limiting for a ColdFusion upstream
http {
    limit_req_zone $binary_remote_addr zone=cf_rl:10m rate=20r/s;
    limit_conn_zone $binary_remote_addr zone=cf_conn:10m;

    server {
        listen 443 ssl;
        server_name coldfusion.example.com;

        client_max_body_size 2m;
        client_body_timeout 10s;
        send_timeout 10s;

        location / {
            limit_req zone=cf_rl burst=40 nodelay;
            limit_conn cf_conn 20;
            proxy_pass http://coldfusion_backend;
        }
    }
}