CVE-2026-75998 Overview
CVE-2026-75998 is an Improper Access Control vulnerability in Adobe ColdFusion that permits arbitrary file system read. An unauthenticated attacker can access sensitive files and directories outside the intended access scope over the network. Exploitation does not require user interaction or elevated privileges.
The issue is tracked under [CWE-284: Improper Access Control] and disclosed in Adobe security bulletin APSB26-119. Successful exploitation results in confidentiality impact only, with no direct effect on integrity or availability of the target system.
Critical Impact
Remote, unauthenticated attackers can read arbitrary files from a vulnerable ColdFusion server, exposing configuration files, credentials, and application source code.
Affected Products
- Adobe ColdFusion (see Adobe advisory APSB26-119 for version details)
- ColdFusion instances exposed to untrusted network access
- ColdFusion deployments without vendor-supplied patches applied
Discovery Timeline
- 2026-09-08 - CVE-2026-75998 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-75998
Vulnerability Analysis
The vulnerability is an Improper Access Control weakness in Adobe ColdFusion. Access decisions inside the affected component fail to enforce the intended authorization boundary. As a result, unauthenticated network requests can reach file read functionality that should be restricted.
An attacker sending crafted requests can retrieve files outside the intended scope. This includes application configuration, credential material, and sensitive data stored on the host. The vulnerability is exploitable over the network with low complexity and no privileges required.
The scope of impact is limited to confidentiality. The advisory does not describe write or execute primitives associated with this specific CVE. Attackers frequently chain file-read primitives with follow-on techniques such as credential reuse or authentication bypass against dependent services.
Root Cause
The root cause is a missing or incorrectly applied access control check in a ColdFusion component that exposes file system read behavior [CWE-284]. The affected code path does not validate whether the requesting principal is authorized to reach the target resource, allowing traversal of the intended access boundary.
Attack Vector
The attack vector is remote and unauthenticated. An attacker sends HTTP requests to an exposed ColdFusion endpoint and requests files outside the intended directory. No user interaction is required, and no valid session is needed. Refer to the Adobe ColdFusion Security Advisory APSB26-119 for the technical scope defined by the vendor.
No public proof-of-concept exploit code has been published at the time of writing. The EPSS score is approximately 0.65% with a percentile near 49.
Detection Methods for CVE-2026-75998
Indicators of Compromise
- Unexpected HTTP requests to ColdFusion administrative or internal endpoints from external addresses
- Access log entries showing file paths outside standard web roots, such as configuration or credential files
- Requests containing traversal sequences or unusual path parameters directed at ColdFusion services
- Outbound traffic from the ColdFusion host following anomalous inbound read requests
Detection Strategies
- Inspect ColdFusion access and application logs for anomalous request patterns targeting non-application file paths
- Correlate web server logs with file system audit events to identify reads of sensitive configuration files by the ColdFusion service account
- Deploy web application firewall rules that flag traversal patterns and access to known ColdFusion sensitive paths
- Baseline normal ColdFusion request patterns and alert on statistical deviations in URI structure or response size
Monitoring Recommendations
- Monitor the ColdFusion service account for reads of files such as neo-security.xml, password.properties, and application credential stores
- Alert on outbound connections initiated from the ColdFusion host immediately after suspicious inbound requests
- Track HTTP response sizes for anomalies that indicate exfiltration of file contents
How to Mitigate CVE-2026-75998
Immediate Actions Required
- Apply the Adobe ColdFusion security update referenced in APSB26-119 as soon as possible
- Restrict network exposure of ColdFusion administrative interfaces to trusted management networks only
- Rotate credentials, API keys, and secrets stored on or accessible to the ColdFusion host if compromise is suspected
- Review historical logs for prior exploitation attempts before patching
Patch Information
Adobe published the fix in security bulletin APSB26-119. Administrators should consult the Adobe ColdFusion Security Advisory for the specific patched builds and applicability to their deployment. Apply the update in accordance with Adobe's installation guidance and verify the patched version after deployment.
Workarounds
- Place ColdFusion behind a reverse proxy or web application firewall that enforces strict URL and path allowlisting
- Run the ColdFusion service under a least-privilege account with file system access limited to required application directories
- Segment ColdFusion hosts from internal networks containing sensitive systems and credentials
- Disable or block access to ColdFusion components that are not required by the application
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
