Key points
- Adobe ColdFusion 2025 up to 2025.0.13 and 2023 up to 2023.0.25 are affected.
- The flaw is rated Critical with a CVSS score of 9.3.
- Switching to Production Secure Profile automatically disables the vulnerable feature.
Adobe ColdFusion users running version 2025 up to 2025.0.13 or version 2023 up to 2023.0.25 face a critical security risk. According to the National Vulnerability Database, a path traversal vulnerability in the Remote Development Service (RDS) component allows attackers to read arbitrary files on the system. This flaw, identified as CVE-2026-90530, carries a CVSS score of 9.3, which is classified as critical.
In plain English
The vulnerability exists in RDS, a feature designed for developers to debug applications. An attacker can exploit this weakness to access sensitive files and directories outside the intended scope. Exploitation does not require user interaction, meaning an attacker can initiate the attack remotely without needing a valid login or triggering any action from a legitimate user. The scope of the vulnerability is changed, indicating the impact extends beyond the vulnerable component itself.
The background
RDS is strictly a development tool and should not be active on production servers. Adobe’s Lockdown Guide specifies that switching ColdFusion to the Production Secure Profile automatically disables RDS. If a server is not using this profile, the guide outlines specific steps to manually disable the feature. This misconfiguration leaves the debugging interface exposed, allowing unauthorized access to the file system through improper pathname limitations.
What changes now
Organizations must verify their ColdFusion configuration immediately. The primary mitigation is disabling the vulnerable component. Administrators should check if their servers are running in Production Secure Profile. If not, they must follow the vendor’s documentation to turn off RDS manually. This action removes the attack vector. The source material lists affected versions but does not state whether a software update exists.
Who needs to act first
Teams should prioritize systems exposed to the internet or untrusted networks. Verify whether the Remote Development Service is enabled on any production servers. If the service is active, disable it immediately using the vendor’s configuration guidelines. Ensure that all development environments are isolated from public access. Review server logs for any suspicious file access attempts that might indicate prior exploitation. Confirm that the Production Secure Profile is enforced across all live instances to prevent similar misconfigurations.
Background: Software updates
Software updates use delta compression to minimize data transfer, verify integrity via digital signatures, and employ transactional installs to ensure the system remains bootable even if the process fails midway.
Read the full guide: How Software Updates Work: The Hidden Verification Steps
What to do and how to stay safe: Adobe ColdFusion
- Check if your ColdFusion server is in Production Secure Profile to ensure RDS is disabled.
- Manually disable RDS if you are not using the secure profile, following the vendor's Lockdown Guide.
- Monitor server logs for unauthorized file access attempts or unusual outbound connections.
- Restrict network access to ColdFusion administration interfaces to trusted IP addresses only.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Adobe ColdFusion versions are affected by CVE-2026-90530?
Adobe ColdFusion 2025 up to 2025.0.13 and Adobe ColdFusion 2023 up to 2023.0.25 are affected.
Is a software patch available for this vulnerability?
The source material does not state whether a software patch is available.
Does exploiting this flaw require a user to log in?
No, exploitation does not require user interaction or valid credentials.
