CVE-2026-76190 Overview
CVE-2026-76190 is an Eval Injection vulnerability in Adobe ColdFusion that allows arbitrary code execution in the context of the current user. The flaw stems from improper neutralization of directives in dynamically evaluated code, classified under [CWE-95]. An attacker can exploit this issue over the network without authentication or user interaction. The vulnerability also carries a changed scope, meaning exploitation can affect resources beyond the vulnerable component. Adobe published the corresponding advisory APSB26-119 on September 8, 2026.
Critical Impact
Unauthenticated remote attackers can inject and execute arbitrary code on affected ColdFusion servers, compromising application integrity across trust boundaries.
Affected Products
- Adobe ColdFusion (versions listed in advisory APSB26-119)
- ColdFusion server-side application environments processing dynamically evaluated code
- Deployments exposing ColdFusion services to untrusted network input
Discovery Timeline
- 2026-09-08 - CVE-2026-76190 published to NVD and Adobe advisory APSB26-119 released
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-76190
Vulnerability Analysis
CVE-2026-76190 is an Eval Injection flaw in Adobe ColdFusion. The vulnerability occurs when the application passes attacker-controlled input into a dynamic code evaluation routine without sufficient neutralization of directives. ColdFusion supports server-side scripting through CFML expressions, and unsafe evaluation of untrusted data allows an attacker to inject syntax that the runtime interprets as executable code.
Successful exploitation results in arbitrary code execution in the context of the current user running the ColdFusion process. The changed scope indicates that impact can propagate to components beyond the vulnerable module, such as backend services, adjacent applications, or hosted content. According to the Adobe ColdFusion Security Advisory, exploitation requires no authentication and no user interaction.
Root Cause
The root cause is improper neutralization of directives passed to a dynamic evaluation function. When ColdFusion evaluates dynamically constructed expressions containing untrusted input, injected directives are parsed and executed by the runtime. This aligns with [CWE-95], Improper Neutralization of Directives in Dynamically Evaluated Code.
Attack Vector
An attacker delivers crafted input over the network to a ColdFusion endpoint that reaches a dynamic evaluation path. The payload contains CFML directives or expressions that the server interprets rather than treating as inert data. Because the flaw is remotely reachable and requires no privileges, exposed ColdFusion instances present an immediate exploitation surface.
No public proof-of-concept has been released at the time of publication. Refer to the Adobe ColdFusion Security Advisory for authoritative technical guidance.
Detection Methods for CVE-2026-76190
Indicators of Compromise
- Unexpected ColdFusion child processes spawning shells, cmd.exe, powershell.exe, or /bin/sh from the ColdFusion service account
- HTTP requests to ColdFusion endpoints containing CFML tag fragments such as <cfexecute>, <cfscript>, or evaluate( in parameters
- Outbound network connections initiated by the ColdFusion JVM to unfamiliar hosts
- New or modified .cfm and .cfc files in web-accessible directories without a corresponding deployment event
Detection Strategies
- Inspect application and web server logs for anomalous parameters that resemble CFML syntax or contain encoded directive characters
- Correlate ColdFusion process telemetry with the creation of scripting interpreters or file writes to web roots
- Alert on ColdFusion service accounts performing reconnaissance commands such as whoami, net user, or ifconfig
Monitoring Recommendations
- Enable verbose logging on ColdFusion Administrator and application endpoints that accept user input
- Forward web server, ColdFusion, and host process telemetry to a centralized analytics platform for correlation
- Monitor egress traffic from ColdFusion hosts and baseline expected destinations
How to Mitigate CVE-2026-76190
Immediate Actions Required
- Apply the patches referenced in Adobe advisory APSB26-119 to all affected ColdFusion installations
- Restrict network exposure of ColdFusion services and administrative interfaces to trusted management networks
- Review recent web and application logs for indicators consistent with eval injection attempts
- Rotate credentials and secrets accessible to the ColdFusion service account if compromise is suspected
Patch Information
Adobe released fixed builds documented in the Adobe ColdFusion Security Advisory (APSB26-119). Administrators should apply the vendor-supplied update matching their deployed ColdFusion version and follow post-installation validation steps described by Adobe.
Workarounds
- Place ColdFusion behind a web application firewall configured to block CFML directive patterns in request parameters
- Remove or disable application code paths that call Evaluate() or equivalent dynamic evaluation functions on untrusted input
- Run ColdFusion under a least-privilege service account to limit blast radius of successful exploitation
- Enforce strict input validation and allowlisting for parameters that feed dynamic expressions
# Configuration example: restrict access to ColdFusion Administrator via firewall
# Allow only trusted management subnet, deny all other sources
iptables -A INPUT -p tcp --dport 8500 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8500 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
