CVE-2026-75994

Executive Summary

CVE-2026-75994 is an Incorrect Authorization (CWE-863) vulnerability affecting ColdFusion that permits an unauthenticated attacker with network adjacency to execute arbitrary code in the context of the current user. The affected component is intended to be reachable only from a restricted administrative network zone by default, which materially constrains the exposed attack surface, but the flaw is rated 9.6 because exploitation requires no user interaction, changes scope (S:C), and yields high confidentiality, integrity, and availability impact. No public proof-of-concept, exploit code, or vendor patch currently exists, leaving defenders dependent on network isolation and compensating controls.

Technical Analysis

The vulnerability class is Incorrect Authorization (CWE-863), meaning the affected component fails to correctly verify that the requester holds the privilege or is operating from the trust context required to perform a protected action. Per the NVD description, this authorization failure can be leveraged to execute arbitrary code in the context of the current user, and the impact scope is recorded as changed in the CVSS vector.

The CVSS:3.1 vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H defines the practical attack surface precisely:

• AV:A (Adjacent): the attacker must be positioned on an adjacent network segment, not the open internet. This aligns with the description that the vulnerable component is restricted to an administrative network zone by default.
• AC:L (Low): no special conditions or race windows are required; the flaw is reliably triggerable once reachable.
• PR:N (None) and UI:N (None): no credentials and no victim interaction are required, so the exploit is fully automated.
• S:C (Changed) with C:H/I:H/A:H: successful exploitation is expected to affect resources beyond the vulnerable component's original security scope, with high impact to confidentiality, integrity, and availability.

Because the CNA title and version data are absent and no affected version range has been published, the precise code path, endpoint, or authorization check that is faulty cannot be stated with confidence. No function names, classes, URL endpoints, file paths, or parameters are provided in the source data, and none are fabricated here. What can be stated at the vulnerability-class level is that an authorization decision in a ColdFusion administrative-zone component is either missing, misordered, or evaluates an attacker-controllable condition as trusted. That defect permits a request that should have been rejected to reach privileged functionality, and the resulting privileged context is what enables arbitrary code execution in the context of the current user. The administrative network zone restriction is a default configuration posture, not a code-level control, so any deployment that has broadened access to the administrative zone (reverse proxies, VPN-to-admin mappings, flat internal networks, misconfigured ACLs) inherits the full adjacent-network exposure described by AV:A.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-75994; the attack chain below is inferred strictly from the vulnerability class (CWE-863), the NVD description, and the CVSS vector. No specific function names, endpoints, file paths, or parameters are asserted.

1. Reconnaissance / target identification: The attacker must already have adjacent-network access to a network segment from which the ColdFusion administrative-zone component is reachable (consistent with AV:A). The attacker enumerates internal hosts for ColdFusion services and identifies instances where the administrative component is exposed beyond its intended restricted zone. This is a secondary prerequisite: without adjacent access, the vulnerability is not reachable.

2. Triggering the flaw class: The attacker sends a crafted request to the affected administrative component. Because the authorization logic is incorrect (CWE-863), the request is processed as though it originated from an authorized context despite arriving with PR:N (no valid credentials) and UI:N (no user interaction). The failure is in the authorization decision itself — the component does not correctly establish that the caller is permitted to perform the requested action.

3. Payload / execution method: Leveraging the improperly authorized access, the attacker causes the component to execute arbitrary code in the context of the current user. The exact mechanism by which code execution is achieved from the authorization bypass is not specified in the available data and is therefore not described here.

4. Post-exploitation impact: With code executing in the context of the current user and scope recorded as changed (S:C), the attacker can access and modify data beyond the component's original security boundary, impacting confidentiality, integrity, and availability at high severity. A successful compromise of a ColdFusion administrative component typically positions an attacker to pivot within the internal environment, so the blast radius extends past the single host toward adjacent systems the compromised service can reach.

Impact Assessment

The CVSS base score is 9.6 (Critical) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Subscores indicate the following:

• Attack Vector (Adjacent) constrains initial exposure: internet-only attackers cannot exploit this directly. This is the single most important mitigating factor and should drive prioritization decisions.
• Attack Complexity (Low) means defenders cannot rely on exploit fragility or timing windows to reduce risk.
• Privileges Required (None) and User Interaction (None) mean no credential or social-engineering barrier exists; any host on the adjacent segment can attempt exploitation unattended.
• Scope (Changed) indicates the compromise escapes the vulnerable component's original authorization boundary, degrading the trust assumptions of neighboring systems.
• CIA impact is High across all three pillars, implying total loss of confidentiality, integrity, and availability for affected resources.

Business impact concentrates on organizations that run ColdFusion in production and whose internal segmentation does not strictly confine the administrative component. Because arbitrary code execution occurs in the context of the current user, the effective blast radius depends on that user's privileges and on what the host can reach. In flat internal networks, a single low-privilege foothold on an adjacent segment can be escalated into code execution on the ColdFusion administrative tier. Combined with the default administrative-zone restriction and the absence of any patch, this CVE is best treated as a high-severity internal-segmentation failure risk rather than an internet-facing emergency, while recognizing that any deployment that has inadvertently exposed the administrative component to a broader network inherits the full 9.6 exposure profile.

Detection Guidance

Sigma Rule

title: ColdFusion Incorrect Authorization Arbitrary Code Execution Attempt (CVE-2026-75994)
id: 3f6a1c2e-9d4b-4a17-8c2e-0b7f5e91a6d3
status: experimental
description: Detects network-adjacent access to ColdFusion administrative components that may indicate exploitation of the incorrect authorization flaw in CVE-2026-75994.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75994
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: coldfusion
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_admin_paths:
    cs-uri-stem|contains:
      - '/CFIDE/'
      - '/CFIDE/administrator/'
  selection_nonlocal_source:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  filter_known_admin_hosts:
    src_ip:
      - '127.0.0.1'
      - '::1'
  condition: selection_method and selection_admin_paths and selection_nonlocal_source and not filter_known_admin_hosts
falsepositives:
  - Legitimate administrative access from management VLANs or jump hosts
  - Vulnerability scanners performing authenticated internal assessments
level: high
tags:
  - attack.t1190
  - cve.2026-75994

YARA Rule

rule CVE_2026_75994_ColdFusion_Incorrect_Authorization
{
    meta:
        description = "Detects ColdFusion administrative component artifacts and indicators consistent with CVE-2026-75994 incorrect authorization exploitation"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75994"
        date = "2026-01-01"
        severity = "critical"
        cve = "CVE-2026-75994"

    strings:
        $cf1 = "ColdFusion Administrator" ascii nocase
        $cf2 = "CFIDE" ascii nocase
        $cf3 = "coldfusion" ascii nocase
        $adm1 = "administrator" ascii nocase
        $auth1 = "isAuthorized" ascii nocase
        $auth2 = "checkAuthorization" ascii nocase
        $auth3 = "getUserRoles" ascii nocase
        $exec1 = "java.lang.Runtime" ascii
        $exec2 = "getRuntime" ascii
        $exec3 = "ProcessBuilder" ascii

    condition:
        uint32be(0) == 0xCAFEBABE or
        (2 of ($cf*) and 1 of ($auth*) and 1 of ($exec*)) or
        (any of ($adm*) and 2 of ($exec*) and 1 of ($cf*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-75994 ColdFusion Incorrect Authorization Attempt"; flow:established,to_server; http.uri; content:"/CFIDE/"; http.uri; content:"administrator"; http.method; content:"GET"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-75994; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75994; sid:202675994; rev:1;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-75994 ColdFusion Admin POST from Non-Admin Zone"; flow:established,to_server; http.uri; content:"/CFIDE/"; http.method; content:"POST"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-admin; reference:cve,2026-75994; sid:202675995; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and
      url.path : "/CFIDE/*" and
      http.request.method in ("GET", "POST") and
      not cidr_match(source.ip, "127.0.0.0/8", "::1/128") ]
  [ process where event.type == "start" and
      process.parent.name in ("java", "java.exe") and
      process.name in ("cmd.exe", "powershell.exe", "sh", "bash", "wscript.exe", "cscript.exe") ]

Splunk SPL Query

index=web OR index=coldfusion sourcetype=access_combined OR sourcetype=coldfusion_access
| search uri_path="/CFIDE/*" OR uri_path="*administrator*"
| eval is_admin_zone = if(cidrmatch("10.0.0.0/8", clientip) OR cidrmatch("172.16.0.0/12", clientip) OR cidrmatch("192.168.0.0/16", clientip), 1, 0)
| where is_admin_zone=1
| stats count values(uri_path) as paths values(status) as status_codes by clientip, host
| where count > 5
| sort - count
| table clientip, host, count, paths, status_codes

Wazuh OSSEC Rule

<group name="coldfusion,web,cve-2026-75994,">
  <rule id="2026759" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/CFIDE/</field>
    <description>CVE-2026-75994: Access to ColdFusion administrative component from non-admin zone detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_75994,attempted_admin,</group>
  </rule>

  <rule id="2026760" level="14">
    <if_sid>2026759</if_sid>
    <field name="url">administrator</field>
    <description>CVE-2026-75994: Possible exploitation of ColdFusion incorrect authorization for code execution</description>
    <mitre>
      <id>T1190</id>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_75994,exploitation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range has been published. Because CVE-2026-75994 is constrained by AV:A, containment is the primary control.

1. Immediate mitigations

• Enforce strict network segmentation so the ColdFusion administrative component is reachable only from a dedicated administrative zone, matching the intended default posture. This directly neutralizes the AV:A prerequisite.
• Restrict and audit any reverse proxy, VPN, or firewall rule that maps broader networks to the administrative component; remove any such mapping that is not strictly required.
• Where feasible, bind or firewall the administrative component to localhost or to a minimal set of management jump hosts, and require authenticated access through a hardened bastion.
• Increase logging and alerting on all access to the administrative component, and treat any request from outside the administrative zone as suspicious (see Detection Guidance above).
• Evaluate host-level controls that block the child-process behavior typical of post-exploitation code execution (for example, restricting script interpreters spawned by the ColdFusion service account).

2. Patch / upgrade steps

• No patch is currently available. Monitor the vendor's security advisory channel and the NVD entry for CVE-2026-75994 continuously; apply the vendor fix immediately upon release.
• Track the vendor's CPSB (ColdFusion Product Security Bulletin) advisories for the corresponding fix and affected-version matrix, since no affected version range has been published yet.

3. Long-term hardening

• Adopt a default-deny network policy for all administrative interfaces across the estate, not only ColdFusion.
• Maintain an inventory of ColdFusion instances and their administrative exposure so that future advisories can be triaged against a known asset list.
• Integrate CVE feeds (NVD, vendor CPSB, OSV) into continuous vulnerability management so that the patch-confidence status of this CVE is re-evaluated as soon as evidence appears.
• Apply least privilege to the account under which the ColdFusion service runs to reduce the impact of arbitrary code execution in the context of the current user.

References

• NVD entry for CVE-2026-75994: https://nvd.nist.gov/vuln/detail/CVE-2026-75994
• CWE-863: Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-75994 is NOT listed as of this report; verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score published yet for this CVE; verify current status): https://www.first.org/epss/

No public proof-of-concept, exploit code, Nuclei template, CISA KEV listing, or observed in-the-wild campaign is associated with CVE-2026-75994 in the data provided. There is no evidence of active exploitation or threat actor attribution at this time.