CVE-2026-76001: Server-Side Request Forgery (SSRF) (CWE-918) in Adobe ColdFusion 2025

CVE-2026-76001 is an SSRF vulnerability in Adobe ColdFusion 2025 that enables a low-privileged attacker to perform server-side request forgery, potentially escalating privileges and gaining elevated access to internal resources. The vulnerability changes the security scope and does not require user interaction for exploitation. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation of this SSRF vulnerability can lead to privilege escalation, allowing an attacker with low privileges to access internal resources with elevated rights. Confidentiality is highly impacted, while integrity is slightly affected, and availability remains unaffected. The attack does not require user interaction but depends on external conditions beyond the attacker's control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, monitor vendor advisories for updates and consider restricting access to ColdFusion services to trusted networks to reduce exposure.