Adobe ColdFusion Patches Nine Vulnerabilities
Adobe fixed multiple ColdFusion flaws including a critical unauthenticated RCE (CVSS 9.9) via eval injection, plus SQLi, XSS, and file-read bugs.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 9 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL published an advisory summarizing a batch of Adobe ColdFusion vulnerabilities patched by Adobe. The most severe, CVE-2026-48273 (CVSS 9.9), is an eval injection flaw allowing a low-privileged attacker to achieve remote code execution without user interaction due to insufficient neutralization of directives in dynamically evaluated code. Other high-severity issues include CVE-2026-75746 (9.1) and CVE-2026-76190 (8.6), an SQL injection vulnerability exploitable by a high-privileged attacker to manipulate query logic and execute arbitrary code, and an improper access control flaw allowing unauthenticated arbitrary file reads bypassing access restrictions.
Additional lower-severity issues include stored and reflected XSS vulnerabilities (some requiring user interaction such as opening a malicious file or visiting a crafted URL), an improper input validation bug enabling code execution after opening a malicious file (particularly relevant in administrative network zones), and an uncontrolled resource consumption flaw that can cause denial of service without user interaction. No in-the-wild exploitation is mentioned in the advisory; this is a routine vendor patch notification.
Defenders running Adobe ColdFusion should apply the vendor-released updates referenced in the advisory as a priority, given the presence of an unauthenticated/no-interaction critical RCE alongside several high-severity issues affecting confidentiality, integrity, and availability. Network segmentation for administrative ColdFusion instances and monitoring for anomalous file access or unexpected code execution are recommended interim mitigations pending patching.
Mentioned in this report
Detection guidance
ColdFusion Process Executing Unexpected Command Interpreter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects ColdFusion application spawning cmd.exe or powershell.exe - indicative of eval injection or code execution vulnerability exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Process Executing Unexpected Command Interpreter
description: Adobe ColdFusion spawning cmd.exe, powershell.exe, or other command interpreters
may indicate exploitation of eval injection (CVE-2026-48273) or similar code execution
vulnerabilities. Generalises on the parent/child process relation rather than specific
payload content.
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \coldfusion.exe
- \cfusion.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
filter_legitimate_admin:
CommandLine|contains:
- /c echo
- -Command Write-Host
condition: selection and not filter_legitimate_admin
falsepositives:
- Administrative scripts or monitoring tools legitimately invoking shell interpreters
from ColdFusion scheduled tasks
- ColdFusion extensions or connectors that spawn system commands for legitimate operations
level: high
id: 1db7e961-91c8-5a6e-8bc2-69c4846489e1
status: experimental
author: Vorant
ColdFusion Accessing System Files Outside Application Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
ColdFusion process reading files from system-sensitive locations (Windows, system32, boot files) - consistent with improper access control exploitation enabling arbitrary file reads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Accessing System Files Outside Application Directory
description: Detects ColdFusion process accessing files in restricted system directories
such as Windows\System32, Windows\Temp root, or boot-related paths. This behaviour
aligns with exploitation of improper access control flaws (CVE-2026-76190) allowing
unauthenticated arbitrary file reads.
tags:
- attack.discovery
- attack.t1005
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \coldfusion.exe
- \cfusion.exe
TargetFilename|contains:
- \Windows\System32
- \Windows\SysWOW64
- \Windows\Boot
- \ProgramData
filter_maintenance:
TargetFilename|contains: \Windows\System32\drivers\etc\hosts
condition: selection and not filter_maintenance
falsepositives:
- ColdFusion running with high privileges for legitimate administrative operations
or log reading
- Antivirus or security software scanning initiated by ColdFusion integration modules
level: medium
id: af09021d-135e-5b6f-96ca-c020e2ba8701
status: experimental
author: Vorant
ColdFusion Executing Code After Opening Suspicious File
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
ColdFusion spawning child processes immediately after opening or parsing files with untrusted extensions - indicative of improper input validation vulnerability exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Executing Code After Opening Suspicious File
description: Detects ColdFusion process creating child processes (especially cmd.exe,
powershell.exe, or executable creation) within a short temporal window after accessing
files outside its application directory or files with suspicious extensions. This
pattern aligns with CVE-2026-48273 eval injection and improper input validation
flaws that enable code execution via malicious files.
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_coldfusion_child:
ParentImage|endswith:
- \coldfusion.exe
- \cfusion.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
- \rundll32.exe
selection_suspicious_args:
CommandLine|contains:
- /c curl
- /c certutil
- -Command IEX
- -nop -w hidden
condition: selection_coldfusion_child and selection_suspicious_args
falsepositives:
- ColdFusion scheduled tasks or batch jobs legitimately invoking system utilities
for administrative purposes
- Third-party ColdFusion extensions performing legitimate file processing workflows
level: high
id: 55a9d481-fcb1-5b4a-a680-6ad3e2bbf459
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0362.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs