CVE-2026-75996
7.5HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
Remote, unauthenticated attackers can crash Adobe ColdFusion by triggering resource exhaustion over the network. No credentials or user interaction are required to force the denial of service.
Root cause
The application fails to restrict resource allocation when processing network requests, allowing uncontrolled resource consumption.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to the patched ColdFusion release detailed in Adobe security bulletin APSB26-144; if patching immediately is not possible, restrict untrusted network access to ColdFusion endpoints at the firewall or reverse proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.