# Adobe ColdFusion Patches Nine Vulnerabilities

Published: 2026-09-09 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/23f1bc76-81e2-5748-84f7-56eb863dc5b6/adobe-coldfusion-patches-nine-vulnerabilities

> Adobe fixed multiple ColdFusion flaws including a critical unauthenticated RCE (CVSS 9.9) via eval injection, plus SQLi, XSS, and file-read bugs.

NCSC-NL published an advisory summarizing a batch of Adobe ColdFusion vulnerabilities patched by Adobe. The most severe, CVE-2026-48273 (CVSS 9.9), is an eval injection flaw allowing a low-privileged attacker to achieve remote code execution without user interaction due to insufficient neutralization of directives in dynamically evaluated code. Other high-severity issues include CVE-2026-75746 (9.1) and CVE-2026-76190 (8.6), an SQL injection vulnerability exploitable by a high-privileged attacker to manipulate query logic and execute arbitrary code, and an improper access control flaw allowing unauthenticated arbitrary file reads bypassing access restrictions.

Additional lower-severity issues include stored and reflected XSS vulnerabilities (some requiring user interaction such as opening a malicious file or visiting a crafted URL), an improper input validation bug enabling code execution after opening a malicious file (particularly relevant in administrative network zones), and an uncontrolled resource consumption flaw that can cause denial of service without user interaction. No in-the-wild exploitation is mentioned in the advisory; this is a routine vendor patch notification.

Defenders running Adobe ColdFusion should apply the vendor-released updates referenced in the advisory as a priority, given the presence of an unauthenticated/no-interaction critical RCE alongside several high-severity issues affecting confidentiality, integrity, and availability. Network segmentation for administrative ColdFusion instances and monitoring for anomalous file access or unexpected code execution are recommended interim mitigations pending patching.

## Mentioned in this report

- Vulnerabilities: CVE-2026-21269, CVE-2026-48273, CVE-2026-75746, CVE-2026-75993, CVE-2026-75998, CVE-2026-75999, CVE-2026-76000, CVE-2026-76002, CVE-2026-76190

## Detection guidance (public sample)

### ColdFusion Process Executing Unexpected Command Interpreter

ATT&CK: T1059

Detects ColdFusion application spawning cmd.exe or powershell.exe - indicative of eval injection or code execution vulnerability exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ColdFusion Process Executing Unexpected Command Interpreter
description: Adobe ColdFusion spawning cmd.exe, powershell.exe, or other command interpreters
  may indicate exploitation of eval injection (CVE-2026-48273) or similar code execution
  vulnerabilities. Generalises on the parent/child process relation rather than specific
  payload content.
tags:
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \coldfusion.exe
    - \cfusion.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  filter_legitimate_admin:
    CommandLine|contains:
    - /c echo
    - -Command Write-Host
  condition: selection and not filter_legitimate_admin
falsepositives:
- Administrative scripts or monitoring tools legitimately invoking shell interpreters
  from ColdFusion scheduled tasks
- ColdFusion extensions or connectors that spawn system commands for legitimate operations
level: high
id: 1db7e961-91c8-5a6e-8bc2-69c4846489e1
status: experimental
author: Vorant
```

### ColdFusion Accessing System Files Outside Application Directory

ATT&CK: T1005

ColdFusion process reading files from system-sensitive locations (Windows, system32, boot files) - consistent with improper access control exploitation enabling arbitrary file reads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ColdFusion Accessing System Files Outside Application Directory
description: Detects ColdFusion process accessing files in restricted system directories
  such as Windows\System32, Windows\Temp root, or boot-related paths. This behaviour
  aligns with exploitation of improper access control flaws (CVE-2026-76190) allowing
  unauthenticated arbitrary file reads.
tags:
- attack.discovery
- attack.t1005
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \coldfusion.exe
    - \cfusion.exe
    TargetFilename|contains:
    - \Windows\System32
    - \Windows\SysWOW64
    - \Windows\Boot
    - \ProgramData
  filter_maintenance:
    TargetFilename|contains: \Windows\System32\drivers\etc\hosts
  condition: selection and not filter_maintenance
falsepositives:
- ColdFusion running with high privileges for legitimate administrative operations
  or log reading
- Antivirus or security software scanning initiated by ColdFusion integration modules
level: medium
id: af09021d-135e-5b6f-96ca-c020e2ba8701
status: experimental
author: Vorant
```

### ColdFusion Executing Code After Opening Suspicious File

ATT&CK: T1059

ColdFusion spawning child processes immediately after opening or parsing files with untrusted extensions - indicative of improper input validation vulnerability exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ColdFusion Executing Code After Opening Suspicious File
description: Detects ColdFusion process creating child processes (especially cmd.exe,
  powershell.exe, or executable creation) within a short temporal window after accessing
  files outside its application directory or files with suspicious extensions. This
  pattern aligns with CVE-2026-48273 eval injection and improper input validation
  flaws that enable code execution via malicious files.
tags:
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_coldfusion_child:
    ParentImage|endswith:
    - \coldfusion.exe
    - \cfusion.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    - \rundll32.exe
  selection_suspicious_args:
    CommandLine|contains:
    - /c curl
    - /c certutil
    - -Command IEX
    - -nop -w hidden
  condition: selection_coldfusion_child and selection_suspicious_args
falsepositives:
- ColdFusion scheduled tasks or batch jobs legitimately invoking system utilities
  for administrative purposes
- Third-party ColdFusion extensions performing legitimate file processing workflows
level: high
id: 55a9d481-fcb1-5b4a-a680-6ad3e2bbf459
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0362.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/23f1bc76-81e2-5748-84f7-56eb863dc5b6/adobe-coldfusion-patches-nine-vulnerabilities.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup