Adobe ColdFusion CVE-2026-75994

Exploitation requires network-adjacent access to the administrative network zone to which the vulnerable ColdFusion component is restricted by default (reflected as AV:A); an attacker reaching that zone needs no authentication, no elevated privileges, and no user interaction (PR:N/UI:N/AC:L) to achieve arbitrary code execution in the context of the current user. The primary limiting factor is this default admin-zone network restriction - organizations that properly segment and firewall the ColdFusion administrative interface are not exposed to arbitrary internet-based attackers, whereas flat networks, exposed admin interfaces, or an existing internal foothold remove that barrier. Affected deployments are ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13).

This is a high-priority vulnerability but with an important deployment-dependent caveat that tempers the raw 9.6 CVSS score. The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes an unauthenticated (PR:N), low-complexity (AC:L) attack with no user interaction that yields full confidentiality, integrity, and availability impact plus a scope change (S:C) - consistent with the CWE-863 Incorrect Authorization flaw enabling arbitrary code execution. Critically, the attack vector is Adjacent (AV:A), not Network, because the description states the vulnerable component is restricted to an administrative network zone by default; this materially reduces real-world exposure versus an internet-facing RCE and means the 9.6 is predicated on an attacker already having a foothold on or routing to the admin zone. No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability and in-the-wild activity cannot be assessed from the data available - absence of these signals is not evidence they are low, merely that they were not supplied. The vulnerability is confirmed by Adobe PSIRT (advisory APSB26-144) and carries an ENISA EUVD identifier, lending high confidence to its existence and affected versions. Signals are broadly consistent (vendor-confirmed critical auth-bypass RCE) with the single moderating factor being the adjacent/admin-zone restriction; treat as a priority patch for ColdFusion operators, while recognizing that organizations correctly segmenting their ColdFusion admin interface face a narrower attack surface than the headline score implies.

An attacker with access to the administrative network zone (e.g., via a compromised internal host, VPN foothold, or flat network) sends a crafted request to the ColdFusion administrative component, bypassing authorization checks due to the incorrect-authorization flaw. Because no authentication, privileges, or user interaction are required (PR:N/UI:N), the attacker triggers arbitrary code execution in the context of the current ColdFusion user, and the scope change (S:C) allows impact beyond the initial component. No public exploit was identified in the provided data, so this scenario is inferred from the CVSS vector and description rather than an observed exploit.