CVE-2026-76190 – Adobe ColdFusion 2025
“One low-privileged login and an eval injection flaw are all it takes for an attacker to run code on your ColdFusion server.”
Adobe's ColdFusion 2025 update fixes four vulnerabilities, two Critical and two High. CVE-2026-48273 has a CVSS score of 9.9, Critical severity. It is an eval injection flaw that lets a low-privileged attacker run arbitrary code with no user interaction. CVE-2026-75746 has a CVSS score of 9.1, Critical severity. It is a SQL injection flaw that an attacker with high privileges can use to run arbitrary code.
CVE-2026-76190 has a CVSS score of 8.6, High severity. It is a second eval injection flaw that leads to remote code execution. CVE-2026-75998 has a CVSS score of 7.5, High severity. It is an improper access control flaw that lets an attacker read sensitive files and directories outside the intended scope, which raises their privileges. None of these flaws require user interaction, and three of them can affect resources beyond the vulnerable component. Patch ColdFusion 2025 servers the same day.
Key Details
- Affected Product
- Adobe Coldfusion
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-95