Key points
- Adobe ColdFusion 2023 up to 2023.0.25 and 2025 up to 2025.0.13 are affected by CVE-2026-105903.
- The flaw is a code injection vulnerability with a CVSS score of 9.9, rated Critical.
- Exploitation requires no user interaction and allows arbitrary code execution as the current user.
Adobe ColdFusion 2023 versions up to 2023.0.25 and 2025 versions up to 2025.0.13 contain a critical security flaw identified as CVE-2026-105903. According to the National Vulnerability Database, this issue stems from improper control of code generation, allowing attackers to inject malicious code. No specific patch version or fix release date is provided in the source material, so administrators must verify current vendor status before proceeding with updates.
In plain English
This vulnerability allows a low-privilege attacker to execute arbitrary code on the server where ColdFusion is running. The code runs in the context of the current user, meaning the attacker gains the same permissions as the application process. Crucially, this exploit does not require any user interaction, such as clicking a link or opening a file, making it easier for remote attackers to target exposed servers.
The background
The National Vulnerability Database assigns CVE-2026-105903 a CVSS score of 9.9, which is classified as Critical severity. The underlying weakness is categorized under CWE-94, known as Improper Control of Generation of Code, commonly referred to as Code Injection. The source material notes that the scope of the vulnerability is changed.
What changes now
Teams must immediately inventory their ColdFusion deployments to identify which instances fall within the affected version ranges. Because exploitation requires no user interaction, any server accessible to the internet or internal network users is at risk. Administrators should prioritize isolating these systems if a vendor update is not yet available, reducing the attack surface until a confirmed fix can be tested and deployed.
Who needs to act first
Teams should prioritize systems with direct internet exposure or those handling sensitive data for immediate review. Before applying any changes, back up the current configuration and data to ensure recovery options exist. Test updates in a non-production environment first to verify compatibility and stability. If a fix is not yet available, consider restricting network access to the affected services temporarily. Document all actions taken to maintain a clear audit trail for compliance and future reference.
What to do and how to stay safe: Adobe ColdFusion
- Check your ColdFusion version against the affected lists: 2023 up to 2023.0.25 and 2025 up to 2025.0.13.
- Monitor official Adobe security advisories for the release of a confirmed patch for CVE-2026-105903.
- Review server logs for signs of unauthorized code execution or unusual activity from low-privileged accounts.
- Ensure network firewalls are configured to limit unnecessary access to ColdFusion management ports.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ColdFusion versions are affected by CVE-2026-105903?
Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13 are affected.
Does exploiting this vulnerability require user interaction?
No, the National Vulnerability Database states that exploitation does not require user interaction.
What is the severity rating of CVE-2026-105903?
The vulnerability has a CVSS score of 9.9, which is rated as Critical.
