CVE-2026-76190: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) in Adobe ColdFusion 2025

CVE-2026-76190 is an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Adobe ColdFusion 2025. This vulnerability allows an attacker to execute arbitrary code remotely without user interaction, exploiting the improper handling of dynamically evaluated code. The vulnerability affects ColdFusion versions up to 12 and up to 23, with a changed scope indicating broader impact. The CVSS v3.1 base score is 8.6, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, changed scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can remotely execute arbitrary code in the context of the current ColdFusion user without any user interaction, potentially leading to unauthorized code execution and system compromise. The changed scope suggests that the vulnerability affects components beyond the initially vulnerable module, increasing the potential impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a patch is available, monitor vendor communications for updates.