External risk intelligence

ColdFusion SQL Injection Vulnerability Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-75746

ColdFusion is a commercial application server platform typically deployed to host web applications and APIs, making it a common internet-facing service. While this specific vulnerability requires high privileges, the product itself is frequently exposed to the public internet as part of standard web architecture.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

ColdFusion is impacted by a critical security flaw that could allow attackers with high privileges to execute malicious code on affected systems. This vulnerability, a type of SQL injection, does not require user interaction and could lead to significant compromise by changing the system's scope.

Flaw allows code execution for privileged attackers.
Critical risk if ColdFusion is internet-facing.
Confirm exposure and relevance to business operations.

Attack Path

How an attacker could exploit the issue

An attacker with high privileges could exploit this SQL injection vulnerability by sending specially crafted input to a vulnerable ColdFusion component. This could allow them to execute arbitrary code on the server, as the vulnerability changes the scope of the system.

Requires high privileges.
Triggers via SQL injection.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker with high privileges to execute arbitrary code when supported by the advisory. This could impact system operations and potentially lead to unauthorized actions within the affected system.

System data and service behavior.
Attacker with high privileges may exploit.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The owners of ColdFusion application servers are responsible for addressing this SQL injection vulnerability. The first practical step is to identify all ColdFusion instances, confirm their exposure and business criticality, and then engage the appropriate application or infrastructure teams to plan remediation.

Identify ColdFusion instances and ownership.
Verify external reachability and business criticality.
Plan risk-based remediation or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe ColdFusion?

ColdFusion is a commercial application server platform used to build and host dynamic websites, web applications, and APIs. It functions as a middleware layer that connects web servers to databases, allowing developers to create data-driven content. Because it powers web-based business logic, it is frequently deployed to handle public-facing traffic.

What does SQL injection mean for CVE-2026-75746?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In this specific case, it means the application fails to properly filter user-supplied input before passing it to database queries. An attacker can leverage this flaw to send malicious commands that the server interprets as instructions, potentially leading to arbitrary code execution.

How is this ColdFusion vulnerability triggered?

An attacker triggers this flaw by submitting specially crafted input to a vulnerable component within the ColdFusion environment. The process does not require any interaction from other users. Crucially, successful exploitation depends on the attacker already possessing high-level administrative privileges, meaning they must have authorized access to the system before they can misuse it to execute unauthorized code.

Is my server at risk if it is behind a firewall?

According to Halo Surface Signal, ColdFusion is frequently deployed as an internet-facing service, which generally increases the accessibility of such flaws. However, because this specific issue requires high-level privileges to initiate, internal instances remain a serious concern if those administrative credentials are compromised. Evaluate your specific deployment to see if the server is exposed to untrusted networks.

Do I need to patch my ColdFusion server immediately?

The first step is to perform an inventory of all ColdFusion instances within your environment to determine which are active and their business criticality. Once identified, verify their network reachability. Coordinate with your infrastructure or application teams to review official vendor guidance and plan a risk-based remediation strategy, focusing first on systems that handle sensitive data or public traffic.

References

helpx.adobe.com/security/products/coldfusion/apsb26-119.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.