CVE-2026-75999: Improper Input Validation (CWE-20) in Adobe ColdFusion 2025

CVE-2026-75999 is an Improper Input Validation vulnerability in Adobe ColdFusion 2025 that could lead to arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this vulnerability by convincing a user to open a malicious file. The affected component is normally restricted to an administrative network zone, limiting exposure. The vulnerability impacts versions up to 12 and up to 23 of ColdFusion. The CVSS 3.1 base score is 8.4, indicating high severity with attack vector as adjacent network, low attack complexity, low privileges required, and user interaction needed. The vulnerability results in a changed scope and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to execute arbitrary code as the current user, potentially leading to full compromise of the affected system within the administrative network zone. The vulnerability affects confidentiality, integrity, and availability with high impact. However, exploitation requires user interaction and is limited to the administrative network zone by default, which may reduce the attack surface.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the administrative network zone and educate users to avoid opening untrusted files. Monitor Adobe's official advisories for updates and apply patches promptly once available.