CVE-2026-75748
7.6HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-918
Impact
High-privilege attackers can pivot through the server to access internal network resources and escalate privileges. They only need administrative access to ColdFusion and network access to the management interface.
Root cause
A server-side request forgery (SSRF) flaw allows the application to be coerced into sending unauthorized requests to internal infrastructure.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Fix & remediation
Apply the update referenced in Adobe advisory APSB26-144, or restrict ColdFusion admin interface access to localhost and trusted management IPs only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.