CVE-2026-12257
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Mura CMS versions prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitized before being processed by the ColdFusion engine. A remote attacker can exploit this to inject and execute arbitrary CFML expressions and instantiate malicious Java objects, compromising system security.
Risk Assessment
The risk for the organization includes full server compromise, data theft, malware installation, and further attacks on internal infrastructure. The vulnerability can be exploited without authentication, increasing its criticality.
Recommendation
Immediately upgrade Mura CMS to version 10.0.712 or later. If an upgrade is not possible, temporarily block access to the “/index.cfm/_api/json/v1/default” endpoint at the network firewall or server configuration.
Original NVD description (English source)
Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion engine. As a result, a remote attacker could exploit this vulnerability to inject and execute arbitrary CFML (ColdFusion Markup Language) expressions and instantiate malicious Java objects, thereby compromising the system’s security.