CVE-2026-76001
7.1HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-918
Impact
Low-privileged remote attackers can exploit SSRF to escalate privileges and access internal network resources. They need valid credentials to an account on the ColdFusion instance.
Root cause
ColdFusion fails to restrict or validate server-side requests, allowing authenticated users to trigger forged requests to internal services.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Fix & remediation
Upgrade ColdFusion to the patched release specified in Adobe advisory APSB26-144. If patching must wait, restrict outbound network access from the ColdFusion server to internal networks and metadata services.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.