ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the cur…

cve CVE-2026-75999 1 source, 1 claim · Watch

NVD writes:
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. the claim

Severity: HIGH NVD
CVSS: 8.4 NVD
Vendor: Adobe NVD
Product: ColdFusion 2025 NVD
CWE: CWE-20 NVD

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Timeline

2026-09-08

first spoke of it: ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

NVD

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

What it is to other things

affects	adobe/coldfusion NVD
made_by	adobe NVD

In words only, so not counted until a person confirms one:

affects

adobe/coldfusion_2025

NVD says “Adobe · ColdFusion 2025”

Every value, with what each source said and its receipt

Property Source Said Means here

Automatable

automatable

NVD

At least one of those steps needs a person.

receipt

Source: NVD
Its words: no
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	no
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2025",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "13",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2023",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "24",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
                "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
                "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
                "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
                "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
                "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*",
                "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*",
                "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*",
                "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*",
                "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*",
                "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*",
                "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*",
                "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
                "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*",
                "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*",
                "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*",
                "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*",
                "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
                "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
                "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
                "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
                "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
                "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
                "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
                "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
                "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*",
                "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*",
                "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*",
                "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*",
                "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*",
                "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*",
                "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*",
                "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*",
                "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*",
                "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*",
                "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*",
                "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*",
                "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
      }
    ],
    "id": "CVE-2026-75999",
    "lastModified": "2026-09-18T14:12:56.810",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75999",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T04:27:12.738691Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T20:18:23.760",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

NVD

8.4

receipt

Source: NVD
Its words: 8.4
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2025",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "13",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2023",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "24",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
                "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
                "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
                "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
                "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
                "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*",
                "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*",
                "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*",
                "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*",
                "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*",
                "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*",
                "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*",
                "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
                "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*",
                "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*",
                "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*",
                "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*",
                "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
                "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
                "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
                "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
                "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
                "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
                "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
                "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
                "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*",
                "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*",
                "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*",
                "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*",
                "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*",
                "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*",
                "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*",
                "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*",
                "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*",
                "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*",
                "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*",
                "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*",
                "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
      }
    ],
    "id": "CVE-2026-75999",
    "lastModified": "2026-09-18T14:12:56.810",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75999",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T04:27:12.738691Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T20:18:23.760",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS vector

cvss_vector

NVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

receipt

Source: NVD
Its words: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2025",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "13",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2023",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "24",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
                "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
                "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
                "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
                "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
                "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*",
                "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*",
                "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*",
                "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*",
                "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*",
                "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*",
                "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*",
                "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
                "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*",
                "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*",
                "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*",
                "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*",
                "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
                "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
                "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
                "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
                "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
                "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
                "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
                "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
                "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*",
                "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*",
                "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*",
                "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*",
                "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*",
                "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*",
                "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*",
                "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*",
                "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*",
                "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*",
                "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*",
                "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*",
                "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
      }
    ],
    "id": "CVE-2026-75999",
    "lastModified": "2026-09-18T14:12:56.810",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75999",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T04:27:12.738691Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T20:18:23.760",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CWE

cwe

NVD

CWE-20

receipt

Source: NVD
Its words: CWE-20
Read by: field:cve.weaknesses[].description[].value
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CWE-20
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2025",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "13",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2023",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "24",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
                "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
                "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
                "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
                "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
                "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*",
                "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*",
                "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*",
                "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*",
                "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*",
                "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*",
                "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*",
                "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
                "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*",
                "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*",
                "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*",
                "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*",
                "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
                "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
                "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
                "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
                "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
                "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
                "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
                "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
                "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*",
                "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*",
                "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*",
                "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*",
                "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*",
                "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*",
                "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*",
                "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*",
                "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*",
                "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*",
                "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*",
                "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*",
                "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
      }
    ],
    "id": "CVE-2026-75999",
    "lastModified": "2026-09-18T14:12:56.810",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75999",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T04:27:12.738691Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T20:18:23.760",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Exploitation

exploitation

NVD

none

No evidence of exploitation, and no public proof of concept.

receipt

Source: NVD
Its words: none
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	none
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2025",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "13",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2023",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "24",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
                "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
                "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
                "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
                "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
                "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*",
                "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*",
                "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*",
                "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*",
                "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*",
                "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*",
                "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*",
                "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
                "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*",
                "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*",
                "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*",
                "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*",
                "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
                "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
                "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
                "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
                "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
                "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
                "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
                "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
                "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*",
                "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*",
                "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*",
                "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*",
                "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*",
                "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*",
                "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*",
                "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*",
                "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*",
                "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*",
                "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*",
                "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*",
                "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
      }
    ],
    "id": "CVE-2026-75999",
    "lastModified": "2026-09-18T14:12:56.810",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75999",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T04:27:12.738691Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T20:18:23.760",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Product

product

NVD

ColdFusion 2025

receipt

Source: NVD
Its words: ColdFusion 2025
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	ColdFusion 2025
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2025",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "13",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2023",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "24",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
                "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
                "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
                "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
                "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
                "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*",
                "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*",
                "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*",
                "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*",
                "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*",
                "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*",
                "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*",
                "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
                "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*",
                "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*",
                "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*",
                "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*",
                "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
                "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
                "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
                "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
                "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
                "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
                "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
                "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
                "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*",
                "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*",
                "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*",
                "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*",
                "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*",
                "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*",
                "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*",
                "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*",
                "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*",
                "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*",
                "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*",
                "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*",
                "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
      }
    ],
    "id": "CVE-2026-75999",
    "lastModified": "2026-09-18T14:12:56.810",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75999",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T04:27:12.738691Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T20:18:23.760",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Severity

severity

NVD

HIGH

From 7.0 to 8.9.

receipt

Source: NVD
Its words: HIGH
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	HIGH
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2025",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "13",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2023",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "24",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
                "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
                "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
                "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
                "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
                "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*",
                "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*",
                "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*",
                "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*",
                "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*",
                "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*",
                "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*",
                "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
                "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*",
                "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*",
                "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*",
                "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*",
                "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
                "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
                "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
                "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
                "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
                "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
                "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
                "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
                "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*",
                "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*",
                "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*",
                "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*",
                "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*",
                "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*",
                "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*",
                "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*",
                "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*",
                "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*",
                "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*",
                "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*",
                "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
      }
    ],
    "id": "CVE-2026-75999",
    "lastModified": "2026-09-18T14:12:56.810",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75999",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T04:27:12.738691Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T20:18:23.760",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}

high

Status

status

NVD

Analyzed

receipt

Source: NVD
Its words: Analyzed
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2025",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "13",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2023",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "24",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
                "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
                "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
                "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
                "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
                "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*",
                "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*",
                "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*",
                "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*",
                "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*",
                "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*",
                "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*",
                "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
                "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*",
                "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*",
                "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*",
                "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*",
                "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
                "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
                "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
                "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
                "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
                "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
                "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
                "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
                "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*",
                "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*",
                "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*",
                "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*",
                "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*",
                "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*",
                "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*",
                "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*",
                "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*",
                "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*",
                "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*",
                "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*",
                "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
      }
    ],
    "id": "CVE-2026-75999",
    "lastModified": "2026-09-18T14:12:56.810",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75999",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T04:27:12.738691Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T20:18:23.760",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Technical impact

technical_impact

NVD

total

The attacker gains full control of the component, or all of its information.

receipt

Source: NVD
Its words: total
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	total
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2025",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "13",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2023",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "24",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
                "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
                "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
                "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
                "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
                "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*",
                "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*",
                "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*",
                "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*",
                "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*",
                "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*",
                "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*",
                "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
                "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*",
                "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*",
                "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*",
                "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*",
                "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
                "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
                "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
                "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
                "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
                "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
                "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
                "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
                "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*",
                "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*",
                "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*",
                "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*",
                "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*",
                "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*",
                "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*",
                "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*",
                "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*",
                "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*",
                "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*",
                "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*",
                "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
      }
    ],
    "id": "CVE-2026-75999",
    "lastModified": "2026-09-18T14:12:56.810",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75999",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T04:27:12.738691Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T20:18:23.760",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

Adobe

receipt

Source: NVD
Its words: Adobe
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Adobe
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2025",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "12",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "13",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "product": "ColdFusion 2023",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "23",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "24",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*",
                "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*",
                "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*",
                "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*",
                "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*",
                "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*",
                "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*",
                "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*",
                "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*",
                "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*",
                "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*",
                "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*",
                "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*",
                "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*",
                "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*",
                "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*",
                "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*",
                "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*",
                "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*",
                "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*",
                "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*",
                "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*",
                "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*",
                "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*",
                "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*",
                "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*",
                "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*",
                "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*",
                "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*",
                "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*",
                "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*",
                "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*",
                "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*",
                "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*",
                "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*",
                "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*",
                "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*",
                "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
      }
    ],
    "id": "CVE-2026-75999",
    "lastModified": "2026-09-18T14:12:56.810",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.7,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75999",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-09T04:27:12.738691Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-08T20:18:23.760",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-20"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Every claim, by kind

vulnerability

zetlyn/cve-nvd · 2026-09-08

automatable no cvss 8.4 cvss_vector CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H cwe CWE-20 exploitation none product ColdFusion 2025 severity HIGH status Analyzed technical_impact total vendor Adobe

source