Managed Service Providers Must Patch ColdFusion 2023/2025 Against Critical CVE-2026-75994 Auth Flaw

Managed service providers must address a critical authorization vulnerability in Adobe ColdFusion immediately. The flaw, identified as CVE-2026-75994, affects specific versions of the application server software. According to the National Vulnerability Database, the issue could result in arbitrary code execution. This capability operates within the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. No user interaction is required for exploitation to occur. The scope of the vulnerability is changed.

How it unfolded

• The National Vulnerability Database recorded CVE-2026-75994 with a critical CVSS score of 9.6.
• The entry details an incorrect authorization weakness mapped to CWE-863.
• The description specifies that the vulnerable component is restricted to an administrative network zone by default.

Who is affected

Adobe ColdFusion 2023 versions up to and including 2023.0.25 are vulnerable to this issue. Users of these older releases face exposure to potential code execution. Adobe ColdFusion 2025 versions up to and including 2025.0.13 are also affected. Organizations running these specific builds must verify their current version status. The vulnerability exists in both major release lines currently in use. The component responsible for the flaw is typically behind administrative controls. However, the lack of required user interaction makes it dangerous. Attackers could potentially exploit the flaw if they reach the administrative zone.

Our take on the response

The classification of this flaw as critical reflects its high severity. The ability to execute code without user interaction is a significant risk factor. The default restriction to an administrative network zone offers some protection. However, this does not eliminate the threat entirely. The changed scope indicates a modification in the vulnerability's nature. The source material lists affected versions but does not confirm a patch. Teams must monitor for vendor updates closely. The urgency stems from the ease of exploitation and the severity of the outcome.

Who needs to act first

Teams should prioritize systems exposed to internal networks where administrative access is possible. Check inventory records to identify all instances of ColdFusion 2023 and 2025. Isolate vulnerable servers from general network traffic if possible. Prepare backup images before making any configuration changes. Monitor logs for unusual activity that might indicate exploitation attempts. Coordinate with security operations centers to enhance detection rules. Communicate with stakeholders about the potential risk and mitigation efforts. Ensure that change management processes are followed for any updates.

What to do and how to stay safe

• Verify the version of Adobe ColdFusion installed on all managed servers.
• Restrict network access to the administrative zones hosting ColdFusion.
• Monitor system logs for signs of unauthorized code execution or access.
• Await official vendor patches and apply them as soon as they are available.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Adobe ColdFusion are vulnerable to CVE-2026-75994?

Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13 are affected.