CVE-2026-75999 is an improper input validation vulnerability (CWE-20) in Adobe ColdFusion 2025. This flaw allows a low-privileged attacker to execute arbitrary code in the context of the current user if a victim opens a crafted malicious file. The affected component is typically restricted to an administrative network zone, limiting exposure. The vulnerability has a CVSS 3.1 base score of 8.4, indicating high severity with attack vector as adjacent network, low attack complexity, requiring low privileges and user interaction, and causing high impact on confidentiality, integrity, and availability with changed scope.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction and is limited to an administrative network zone by default, which reduces the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor Adobe's advisories for updates. Restricting access to the administrative network zone and exercising caution with opening files can reduce risk until a patch is available.