Loading vulnerability…
Uncontrolled Resource Consumption in Adobe ColdFusion
CVE-2026-75996 is an uncontrolled resource consumption vulnerability in Adobe ColdFusion 2023 releases before Update 26 and ColdFusion 2025 releases before Update 14, affecting all platforms. An unauthenticated network attacker can exhaust system resources and cause application denial-of-service without user interaction. The vulnerability is rated High with a CVSS v3 score of 7.5. The affected function and specific triggering input have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exhausts system resources and disrupts the availability of the affected ColdFusion application. No confidentiality or integrity impact is identified for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is specified. Adobe recommends applying ColdFusion security configuration settings and following the applicable ColdFusion Lockdown Guide; these general hardening measures are not established substitutes for the security update.
Patch, then assume compromise.
Apply the security updates in Adobe bulletin APSB26-144: upgrade ColdFusion 2023 to Update 26 (2023.0.26), ColdFusion 2025 to Update 14 (2025.0.14), or a later vendor-supported release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.