Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion engine. As a result, a remote attacker could exploit this vulnerability to inject and execute arbitrary CFML (ColdFusion Markup Language) expressions and instantiate malicious Java objects, thereby compromising the system’s security.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Mura CMS 10․0․712 patched for critical RCE flaw in endpoint /index․cfm/_api/json/v1/default, with CVE-2026-12257 assigned https://ift.tt/pSzT6sU
Post summary
Mura CMS version 10.0.712 has been patched to address a critical remote code execution flaw identified as CVE-2026-12257 affecting the /index.cfm/_api/json/v1/default endpoint.