APSB26-119 carries Adobe’s most urgent priority rating and Adobe’s own statement that it is not aware of any exploits in the wild — a combination that means the vendor expects this product to be attacked.
What happened
Adobe published security bulletin APSB26-119 for ColdFusion on Tuesday, September 8, 2026. The bulletin’s own metadata gives both a publication date and a last-updated date of September 8, 2026. Eight of its CVEs entered NVD at 8:17 p.m. and 8:18 p.m. UTC the same evening.
The bulletin covers nine CVEs across two shipping releases:
- ColdFusion 2025 — versions 2025.0.12 and earlier are affected; the fix is 2025.0.13.
- ColdFusion 2023 — versions 2023.0.23 and earlier are affected; the fix is 2023.0.24.
Both are marked all-platforms. Both updates carry a priority rating of 1.
The three highest-scored issues:
- CVE-2026-48273 — Eval Injection, CWE-95, “could result in arbitrary code execution in the context of the current user.” CVSS 9.9,
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Credited to AnirudhAnand (a0xnirudh). - CVE-2026-75746 — SQL Injection, CWE-89, “could result in arbitrary code execution.” CVSS 9.1,
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Credited to wayne g (waynezinn). - CVE-2026-76190 — Eval Injection, CWE-95, “could result in arbitrary code execution.” CVSS 8.6,
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N.
The rest: CVE-2026-75993, reflected XSS at 8.5; CVE-2026-75999, improper input validation at 8.4; CVE-2026-75998, improper access control leading to arbitrary file system read at 7.5 and reachable with no privileges at all; CVE-2026-76000, resource consumption at 6.5; CVE-2026-76002, reflected XSS at 6.1; and CVE-2026-21269, stored XSS at 4.6. Adobe labels the first six of those nine Critical, including the 7.5.
On exploitation the bulletin is unambiguous. It states: “Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.”
What Priority 1 means when nothing is being exploited
Adobe’s published rating scale defines Priority 1 as an update that “resolves vulnerabilities being targeted, or which have a higher risk of being targeted, by exploit(s) in the wild,” with the recommendation that administrators install it “as soon as possible. (for example, within 72 hours).”
That definition has two halves joined by an “or,” and only the second half applies here. Adobe has said in the same document that nothing in this set is being exploited. So the rating is not a report of attacks; it is a forecast. Priority 2, the next rung down, is defined as resolving “vulnerabilities in a product that has historically been at elevated risk. There are currently no known exploits” — with a 30-day window. Adobe had a rating that matched the literal facts and did not use it.
Read the two documents together and the message is legible: Adobe assesses this particular product, at this moment, as more likely than not to draw exploit development, and has compressed its own guidance from thirty days to three on that basis alone. That is a more useful signal than a CVSS number, and it is one the CVE records do not carry — none of the nine CVE records contains a priority field, because CVE has no such field. An organization that triages ColdFusion from NVD alone sees nine scores and no urgency. The urgency is in the bulletin.
Why it matters
The scoring inside the set repays a second look, because the ordering it produces is not the ordering an attacker would use.
CVE-2026-48273 is the headline number at 9.9, and it requires PR:L — a low-privileged account. CVE-2026-75746 at 9.1 requires PR:H, a high-privileged one; on a ColdFusion instance that is close to saying an administrator can attack the server they already administer. The only remote-code-execution issue in the set that requires no authentication is CVE-2026-76190, and it is scored 8.6 — third.
Look at why. CVE-2026-76190 is vectored C:N/I:H/A:N: no confidentiality impact, high integrity impact, no availability impact. Adobe’s own impact column for it reads “Arbitrary code execution.” An unauthenticated attacker who achieves arbitrary code execution on a server has, by any ordinary reading, obtained confidentiality impact — the code can read files. The record says otherwise, and the 1.3-point gap between it and the 9.9 is built substantially on that pair of Ns.
That shape points at something structural rather than careless. The impact metrics are meant to describe what the vulnerability does to the vulnerable component’s security properties, and vendors triaging dozens of issues at once fill them from a category template rather than from the exploit. Eval injection gets one template, SQL injection gets another, and the resulting scores are internally consistent with the templates and not with each other. That is fine for a bulletin a human reads top to bottom. It is not fine for a queue sorted by number, which is how most organizations actually consume these.
There is also a record wrinkle worth flagging. CVE-2026-21269, the stored XSS at the bottom of today’s bulletin, is not new: NVD shows it published on August 11, 2026, with its status now “Modified” and its last-modified timestamp updated at 8:17 p.m. UTC on September 8, 2026, as today’s bulletin was ingested. NVD scores it 5.4 on vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N; Adobe’s bulletin scores it 4.6 on CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The disagreement is one metric — attack vector, Network in NVD’s copy and Local in Adobe’s — and it is the difference between a flaw someone can reach across the network and one they cannot. Both numbers are live in public feeds right now. Neither is annotated as disputed.
None of this changes the instruction. There is one update per release, it fixes all nine, and Adobe wants it inside 72 hours. But it changes what you tell a stakeholder who asks why a 4.6 and an 8.6 are being patched in the same emergency window: because the vendor’s urgency signal is not the score, and on this bulletin the score is doing a worse job than usual.
What to do
- Update ColdFusion 2025 to 2025.0.13 and ColdFusion 2023 to 2023.0.24. Adobe’s guidance for a Priority 1 update is “as soon as possible. (for example, within 72 hours)” — that is September 11, 2026 for anyone starting today.
- Treat CVE-2026-76190 as the one to reason about first, not the 9.9. It is the only code-execution issue in the set with
PR:N, and its lower score comes from impact metrics that read oddly against its own stated impact. - Check whether your ColdFusion instances are internet-reachable at all. Two issues here — CVE-2026-76190 and the 7.5 file-read, CVE-2026-75998 — need no credentials and no user interaction. Neither matters from the internet if the administrator interface and the application are not exposed there.
- Apply the ColdFusion lockdown guidance if you have not. It does not substitute for the update, and Adobe publishes no workaround for these issues.
- If your scanner reports CVE-2026-21269 at 5.4 and your vendor feed says 4.6, both are being published as written. The gap is the attack-vector metric, and it is not resolved.
Sourcing note
Checked: Adobe security bulletin APSB26-119 at helpx.adobe.com/security/products/coldfusion/apsb26-119.html, which rendered in full and supplied the affected and updated versions, the priority rating, the nine-CVE table with scores and vectors, the exploitation statement quoted above and the acknowledgements. Adobe’s rating definitions at helpx.adobe.com/security/severity-ratings.html for the Priority 1 and Priority 2 wording, quoted verbatim. NVD records for the ColdFusion CVEs published September 8, 2026, and separately for CVE-2026-21269, for the independent scores and timestamps.
Could not reach: nothing relevant was unreachable for this story. The bulletin is served as static HTML at the URL the CVE records cite.
Unresolved: the NVD-versus-Adobe disagreement on CVE-2026-21269’s attack vector is reported as observed on both sources and has not been adjudicated by either. The reason CVE-2026-76190 carries C:N and A:N alongside an impact of arbitrary code execution is not explained in the bulletin, and no explanation was sought from Adobe. Adobe’s statement that it is aware of no exploits is reproduced as the vendor’s own words and describes what Adobe knew at publication; it is not a guarantee about the days since.