CVE-2026-75994: Incorrect Authorization (CWE-863) in Adobe ColdFusion 2025

CVE-2026-75994 is an Incorrect Authorization vulnerability in Adobe ColdFusion 2025 that enables arbitrary code execution by an attacker without user interaction. The vulnerability affects ColdFusion versions up to and including 2025.0.13 and 2023.0.25. The affected component is typically restricted to an administrative network zone, but exploitation changes the security scope, allowing code execution with high impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 9.6, reflecting critical severity with attack vector requiring adjacent network access, low attack complexity, no privileges required, and no user interaction.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the affected ColdFusion server. The vulnerability impacts confidentiality, integrity, and availability at a high level. The affected component is by default limited to an administrative network zone, which may reduce exposure but does not eliminate risk.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Since the vulnerable component is restricted to an administrative network zone by default, ensure network segmentation and access controls are properly enforced to limit exposure. Monitor Adobe's official channels for updates and apply patches once available.