CVE-2026-75748

HighCVSS 7.6/10Last modified Oct 20, 2026

Description

ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Adobe	ColdFusion 2025	<= 2025.0.13
Adobe	ColdFusion 2023	<= 2023.0.25

References

https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.htmlVendor Advisory

Timeline

Published: Oct 13, 2026
Last modified: Oct 20, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-757497.8Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th CVE-2026-757507.8Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context CVE-2026-757525.5Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker coul CVE-2026-757535.3Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTT CVE-2026-7575410.0Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center a CVE-2026-757578.3Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling CVE-2026-757585.9Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_stri CVE-2026-757597.6Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary CVE-2026-757607.1Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and creden CVE-2026-757667.8Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context CVE-2026-757677.8Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context CVE-2026-757687.8Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of