Key points
- The National Vulnerability Database rates CVE-2026-105903 as critical with a CVSS score of 9.9.
- Affected versions include Adobe ColdFusion 2025 up to 0.13 and 2023 up to 0.25.
- Exploitation does not require user interaction, allowing low-privileged attackers to execute code.
The short version
- Adobe ColdFusion contains a code injection flaw that enables remote code execution.
- The vulnerability is rated critical by the National Vulnerability Database.
- No user interaction is required for an attacker to exploit this issue.
The details
The National Vulnerability Database lists CVE-2026-105903 as a critical security flaw in Adobe ColdFusion. The issue stems from improper control of code generation, classified under CWE-94. This weakness allows for arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this vulnerability to run their own code on the affected system. The NVD assigns a CVSS score of 9.9 to this issue, indicating severe risk. The scope of the vulnerability is noted as changed in the record. Exploitation does not require any interaction from the user, making it accessible to remote attackers.
The vulnerability affects specific versions of Adobe ColdFusion. The National Vulnerability Database identifies ColdFusion 2025 versions up to 2025.0.13 as affected. It also lists ColdFusion 2023 versions up to 2023.0.25 as vulnerable. Organizations running these versions are exposed to the risk of remote code execution. The lack of required user interaction means that an attacker does not need to trick a user into clicking a link or opening a file. The attack can be executed directly against the server.
The context
This vulnerability highlights the risks associated with server-side code injection flaws. The NVD description emphasizes that the flaw allows arbitrary code execution. This means an attacker could potentially take full control of the affected system. The low-privilege requirement for exploitation broadens the potential attack surface. Any user or service with low-level access could leverage this flaw. The critical rating reflects the ease of exploitation and the severity of the impact. The changed scope indicates that the vulnerability affects components beyond the initial vector.
Organizations relying on Adobe ColdFusion for web applications or internal services are at risk. The affected versions cover recent releases of the 2023 and 2025 series. This suggests that many current deployments may be vulnerable. The absence of user interaction requirements makes this a high-priority issue for security teams. It underscores the importance of identifying and patching known vulnerabilities promptly. The specific version ranges provided by the NVD allow for precise identification of affected systems.
What to watch
- Monitor for any new advisories from Adobe regarding ColdFusion updates.
- Check internal logs for signs of unauthorized code execution.
- Review network traffic for unusual outbound connections from ColdFusion servers.
- Verify that all ColdFusion instances are outside the affected version ranges.
What it means for organisations
Security teams should immediately inventory all ColdFusion installations. Determine which systems run the affected versions. Assess the exposure of these systems to external networks. Inform application owners and infrastructure managers of the risk. Evaluate the potential impact on business operations if systems are compromised. Coordinate with vendors to understand any interim mitigation strategies. Ensure that incident response plans account for remote code execution scenarios.
What to do and how to stay safe
- Identify all instances of Adobe ColdFusion on your network.
- Check the version number against the affected ranges listed by the NVD.
- Isolate affected systems from external networks if patching is not immediate.
- Monitor for unusual activity that may indicate exploitation.
Step-by-step guide: Automatic Software Updates: Definition, Mechanics and Hidden Risks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-105903?
It is a critical code injection vulnerability in Adobe ColdFusion that allows remote code execution.
Which versions of ColdFusion are affected?
ColdFusion 2025 up to 0.13 and 2023 up to 0.25 are affected.
Does exploitation require user interaction?
No, the National Vulnerability Database states that exploitation does not require user interaction.
