CVE-2026-75998 is an improper access control vulnerability (CWE-284) in Adobe ColdFusion 2025 that enables an unauthenticated attacker to read arbitrary files on the server's file system. The flaw allows access to sensitive files and directories beyond the intended permissions. Exploitation does not require any user interaction, increasing the risk of automated or remote attacks. No official patch or remediation guidance has been published by Adobe as of the data provided.

Successful exploitation could lead to unauthorized disclosure of sensitive information stored in files and directories accessible by the ColdFusion server. This could compromise confidentiality but does not affect integrity or availability. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor Adobe's advisories for updates. Until a patch is available, restricting network access to the ColdFusion server and minimizing exposure may reduce risk.