Vulnerability · Published Jul 13, 2026 · Assigned by INCIBE
CVE-2026-12257Remote code execution in Mura Software’s CMS
Critical 9.3
In plain English
A critical-severity code injection in CMS from Mura Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Official description
Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion engine. As a result, a remote attacker could exploit this vulnerability to inject and execute arbitrary CFML (ColdFusion Markup Language) expressions and instantiate malicious Java objects, thereby compromising the system’s security.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mura Software | CMS | 10.0.712 |
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N