Advisoriesby IbisAdobeCVE-2026-75998
Adobe ColdFusion: improper access control
No fix yet
ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| ColdFusion 2023 Product | <= 23 | No fix yet |
| ColdFusion 2025 Product | <= 12 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-284