Low-Privilege Attackers Can Execute Code on Adobe ColdFusion Servers

Attackers can now run arbitrary code on servers running vulnerable versions of Adobe ColdFusion. The National Vulnerability Database describes this flaw as a code injection issue that results in remote code execution. Security teams face a high-risk scenario because the exploit does not require any user interaction. This means an attacker does not need to trick a user into clicking a link or opening a file. The breach can occur automatically when the server processes specific inputs.

In plain English

The core problem involves how the application handles incoming data. Instead of treating input as simple text, the system mistakenly executes it as instructions. This allows a remote attacker to inject malicious commands into the server's processing logic. The National Vulnerability Database identifies this as an improper control of code generation. Because the flaw exists in the server's core functionality, it grants the attacker the same permissions as the current user running the service. This level of access is significant for any organization relying on the platform.

The background

The National Vulnerability Database assigned the identifier CVE-2026-105903 to this specific weakness. It carries a CVSS score of 9.9, which falls into the Critical severity range. The database notes that the scope of the vulnerability is changed, indicating a high potential for impact. The flaw is linked to CWE-94, which covers improper control of code generation or code injection. This classification highlights the fundamental error in how the software distinguishes between data and executable code.

What changes now

Organizations using Adobe ColdFusion must verify their current software versions immediately. The National Vulnerability Database states that versions of ColdFusion 2025 up to 2025.0.13 are affected. Similarly, versions of ColdFusion 2023 up to 2023.0.25 are also vulnerable. Security teams should check their inventory for these specific release numbers. If an organization is running any version within these ranges, it is exposed to remote code execution risks. No patch details were provided in the source material.

What made it possible

Code injection flaws typically arise when applications fail to separate user-supplied data from executable logic. In these scenarios, the system processes input as commands rather than static text. This weakness often serves as an initial access vector, allowing attackers to bypass authentication or privilege boundaries. Teams usually encounter this when applications lack strict input validation or sanitization. Checking whether legacy components handle dynamic content safely is a common mitigation strategy. Understanding this pattern helps defenders recognize similar risks in other software environments.

What to do and how to stay safe: Adobe ColdFusion

• Verify the exact version of Adobe ColdFusion installed on all servers to determine if it falls within the affected ranges.
• Monitor server logs for unusual activity or unexpected code execution, as exploitation requires no user interaction.
• Restrict network access to ColdFusion services to trusted IPs until a vendor update is available.
• Review application configurations to ensure strict input validation is enforced where possible.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Adobe ColdFusion are affected by this vulnerability?

Adobe ColdFusion 2025 up to version 2025.0.13 and Adobe ColdFusion 2023 up to version 2023.0.25 are affected.

Does an attacker need user interaction to exploit this flaw?

No, the National Vulnerability Database states that exploitation does not require user interaction.

What is the severity rating of CVE-2026-105903?

The vulnerability has a CVSS score of 9.9, which is rated as Critical.