CVE WatchJul 13, 2026

CVE-2026-12257

Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/i

CVSS

—

No CVSS

EPSS

0.4%

p33

KEV

—

Exploit Today

0-100

Published: Jul 13, 2026 · Last modified: Jul 13, 2026 · CWE-94

EPSS · 30d

0.4%EPSS · 30 days0.4%

2026-07-142026-07-20

Technical description

Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion engine. As a result, a remote attacker could exploit this vulnerability to inject and execute arbitrary CFML (ColdFusion Markup Language) expressions and instantiate malicious Java objects, thereby compromising the system’s security.

Official references

www.incibe.eshttps://www.incibe.es/en/incibe-cert/notices/aviso/remote-code-execution-mura-softwares-cms

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-32489.8 CRI

100.0%

KEV—80Langflow Missing Authentication Vulnerability6d CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability6d CVE-2026-154107.2 HIG

71.2%

KEV—71SonicWall SMA1000 Appliances Code Injection Vulnerability5d CVE-2025-670389.8 CRI

55.4%

KEV—67Lantronix EDS5000 Code Injection Vulnerability15d CVE-2021-416539.8 CRI

99.5%

——30The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.12d CVE-2023-362558.8 HIG

99.0%

——30An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.12d