CVE-2026-75746: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) in Adobe ColdFusion 2025

CVE-2026-75746 is an SQL Injection vulnerability in Adobe ColdFusion 2025 caused by improper neutralization of special elements used in SQL commands (CWE-89). This flaw enables an attacker with high privileges to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects ColdFusion versions up to 12 and up to 23. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity, and availability.

An attacker with high privileges can exploit this vulnerability remotely to execute arbitrary code in the context of the current user. This can lead to full compromise of the affected system, including unauthorized data access, modification, and potential denial of service. The vulnerability does not require user interaction, increasing the risk of automated exploitation. The changed scope suggests that the impact extends beyond the initially vulnerable component, potentially affecting other parts of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, restrict high-privilege access to the affected ColdFusion instances and monitor for suspicious activity related to SQL injection attempts.