Adobe ColdFusion: Code injection leading to arbitrary code execution
Summary
Adobe ColdFusion 2023 up to 2023.0.25 and 2025 up to 2025.0.13 contain a code injection flaw (CWE-94). An attacker with a low-privileged account on the network can run arbitrary code in the context of the current user. No user interaction is required, and the scope is changed, so the impact can extend beyond the vulnerable component. Adobe is not aware of exploits in the wild, and no public proof of concept was found.
Affected
- Adobe ColdFusion 2025: 2025.0.13 and earlier
- Adobe ColdFusion 2023: 2023.0.25 and earlier
Fixed in
- Adobe ColdFusion 2025: Update 14 (2025.0.14)
- Adobe ColdFusion 2023: Update 26 (2023.0.26)
Workaround
Unknown. No vendor-documented workaround for this CVE. Apply the update.
Exploitation
- Adobe states it is not aware of any exploits in the wild for the issues in this update.
- A third-party aggregator reports that the CVE is not in the CISA KEV catalog. Verify this directly at CISA.
- No public proof of concept found.
Our recommendation
- Inventory all ColdFusion instances of the 2023 and 2025 branches and record their exact build versions.
- Update to 2025.0.14 or 2023.0.26 or later, with priority for internet-facing servers.
- Review accounts with access to ColdFusion and remove unused or default accounts, since a low-privileged account is the precondition.
- Restrict admin and RDS interfaces to internal networks and check internet reachability with an external scan.
- Monitor APSB26-144 and the CISA KEV catalog for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-144 www.adobe.com
- Adobe ColdFusion 2023 Update 26 release notes guides.adobe.com
- HKCERT security bulletin: Adobe October 2026 security update www.hkcert.org
- Tenable plugin 366551 www.tenable.com
- Zero Day Initiative: October 2026 security update review www.zerodayinitiative.com
- Strix CVE record CVE-2026-105903 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:23.
Original description (NVD)
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.