CVE-2026-75996High· 7.5▾ TwilightColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-o…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.9%
ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90530Critical· 9.3ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read
CVE-2026-75995High· 8.4ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user
CVE-2026-76001High· 7.1ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation
CVE-2026-75748High· 7.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation
CVE-2026-75994Critical· 9.6ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user
CVE-2026-71385High· 8.4ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user