cyfenced.com →

[ CVE-2026-90530 · Published 13 Oct 2026 ]

Vulnerability in Adobe ColdFusion 2025

CVSS 9.3 EPSS <1%3 agency advisoriesNo fix listed yet

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.3

[ Description ]Official description

ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • NCSC-NLNCSC-2026-0435

    Vulnerabilities fixed in Adobe ColdFusion Translated from Dutch

    Probability/damage M/HCVE-2026-105897CVE-2026-105898CVE-2026-105899+29 more CVEs
  • CERT-FRCERTFR-2026-AVI-1301

    Multiple vulnerabilities in Adobe products Translated from French

    Multiple vulnerabilities have been discovered in Adobe products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-71385CVE-2026-92911CVE-2026-95631+41 more CVEs
  • BSI CERT-BundWID-SEC-2026-3945

    Adobe ColdFusion: Multiple vulnerabilities Translated from German

    CVE-2026-106618CVE-2026-106623CVE-2026-71385+29 more CVEs

[ References ]References