Adobe ColdFusion Critical CVE-2026-105903 Enables Remote Code Execution Without User Interaction

Adobe ColdFusion contains a critical code injection vulnerability that permits low-privileged attackers to execute arbitrary code. This flaw affects specific versions of the 2023 and 2025 product lines, creating a significant risk for environments running outdated software.

What happened

The National Vulnerability Database records CVE-2026-105903 as a critical security issue within Adobe ColdFusion. The vulnerability stems from improper control over the generation of code, categorized under CWE-94. This weakness allows a low-privileged attacker to inject and execute arbitrary code in the context of the current user.

According to the NVD record, exploitation of this issue does not require any user interaction. Attackers can leverage this flaw remotely to gain control over the system. The scope of the vulnerability is changed, indicating that the impact extends beyond the initial component affected by the injection.

Adobe ColdFusion 2025 versions up to 2025.0.13 are explicitly listed as affected by this code injection flaw. Similarly, Adobe ColdFusion 2023 versions up to 2023.0.25 are vulnerable to this attack vector. Systems running these specific version ranges are at risk of arbitrary code execution.

Why it matters

The CVSS score of 9.9 reflects the severe nature of this vulnerability. A score in this range indicates that the flaw is easily exploitable and has a high impact on confidentiality, integrity, and availability. The critical rating demands immediate attention from security teams managing these environments.

The ability to execute arbitrary code without user interaction makes this threat particularly dangerous. Attackers do not need to trick users into clicking links or opening files. This lowers the barrier for exploitation, allowing automated tools to scan for and compromise vulnerable systems at scale.

What to watch

• Monitor vendor announcements for patch availability and release dates.
• Check system logs for signs of unauthorized code execution or unusual activity.
• Verify current ColdFusion versions against the affected list provided by Adobe.
• Assess network exposure to identify which instances are accessible from external networks.

Who needs to act first

Teams should prioritize systems exposed to the internet or untrusted networks for immediate review. Isolate critical instances if possible to limit potential lateral movement while awaiting a fix. Conduct a thorough inventory of all ColdFusion deployments to determine which versions are affected. Coordinate with development teams to test any future patches in a staging environment before production rollout. Ensure backups are current and verified to facilitate rapid recovery in case of compromise.

What to do and how to stay safe: Adobe ColdFusion

• Audit all servers running Adobe ColdFusion to identify versions 2025.0.13 and earlier, or 2023.0.25 and earlier.
• Restrict network access to ColdFusion instances using firewalls to limit exposure to untrusted sources.
• Monitor application logs for anomalous requests or unexpected code execution patterns indicative of exploitation.
• Prepare an incident response plan that includes steps for isolating and remediating compromised systems once a fix is available.

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Adobe ColdFusion versions are affected by CVE-2026-105903?

Adobe ColdFusion 2025 up to 2025.0.13 and Adobe ColdFusion 2023 up to 2023.0.25 are affected.

Does exploiting this vulnerability require user interaction?

No, exploitation of this issue does not require user interaction.

What is the CVSS score for CVE-2026-105903?

The CVSS score is 9.9, which is rated as critical.