CVE-2026-12257

Remote code execution in Mura Software’s CMS

Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion engine. As a result, a remote attacker could exploit this vulnerability to inject and execute arbitrary CFML (ColdFusion Markup Language) expressions and instantiate malicious Java objects, thereby compromising the system’s security.

We have discovered 829 live websites that are affected by CVE-2026-12257.

Run a Free Instant Scan



Affected Software

Product  Mura CMS
Category Content Management System
Vulnerable Domains829 live websites (95% of Mura CMS install base)
Vulnerable Versions
  • from 0 through 10.0.712
Vulnerable Versions Count57 versions ( 86% of all versions)


Common Weakness Enumeration

CWE-94 Improper Control of Generation of Code ('Code Injection')



Details

  • Published - Jul 13, 2026
  • Updated - Jul 13, 2026

Credits

  • Miguel Segovia Gil (finder)

Website Distribution by Country

Number of websites using CVE-2026-12257
United States452 websites


GB81 websites
Switzerland61 websites
Germany59 websites
Netherlands38 websites
France33 websites
Italy31 websites
Czech Republic20 websites
Canada17 websites
Belgium12 websites

Website Distribution by TLD

Number of websites using CVE-2026-12257
.com319 websites
.org141 websites
.ch59 websites
.it32 websites
.net23 websites
.nl22 websites
.co.uk21 websites
.edu21 websites
.cz16 websites
.be15 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-12257

Top websites that are affected by CVE-2026-12257. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.com United States*,***
***********.info United States**,***
*******.org United States**,***
***.***.wales GB**,***
***.***.uk United States**,***
**********.com United States**,***
****.org Germany**,***
**.**.gov United States**,***
*****.org Germany**,***
****.org Germany**,***
See full domain list

FAQ

CVE-2026-12257 is Improper Control of Generation of Code ('Code Injection') in Mura CMS
A total of 829 websites have been identified as vulnerable to CVE-2026-12257, based on global website indexing conducted by WebTechSurvey.
The Mura CMS is affected by the CVE-2026-12257 vulnerability.
Mura CMS versions up to and including 10.0.712 are vulnerable to CVE-2026-12257.