Adobe ColdFusion Users Urged to Enable Production Secure Profile Against Critical Unauthenticated File Read

Adobe ColdFusion contains a critical path traversal vulnerability in its Remote Development Services (RDS) component. The National Vulnerability Database rates the issue as critical with a CVSS score of 9.3.

What happened

The National Vulnerability Database published details for CVE-2026-90530, identifying a flaw in Adobe ColdFusion’s Remote Development Services. This vulnerability stems from improper limitation of a pathname to a restricted directory, classified under CWE-22. An attacker can exploit this issue to perform arbitrary file system reads. The flaw allows access to sensitive files and directories outside the intended scope. Exploitation does not require user interaction or authentication.

Adobe ColdFusion 2023 up to version 2023.0.25 is affected. Adobe ColdFusion 2025 up to version 2025.0.13 is also impacted. The NVD record notes that the scope of the vulnerability is changed. Remote Development Services is designed solely as a development feature for debugging purposes. It is not intended for use in production environments.

Why it matters

Exposing sensitive files to unauthenticated attackers creates significant data breach risks. Organizations using ColdFusion for web applications must ensure RDS is not accessible from the internet. The vulnerability allows remote attackers to traverse directory structures. This could lead to the exposure of configuration files, source code, or other sensitive data. The lack of required user interaction simplifies automated exploitation attempts.

What to watch

• Monitor Adobe security advisories for patch releases.
• Check server logs for unusual file access patterns.
• Verify that RDS is disabled on all production servers.
• Review network access controls for ColdFusion instances.

Who needs to act first

Teams should prioritize systems exposed to external networks. Check whether Remote Development Services is enabled on production servers. Disable RDS immediately if it is active. Switching to the Production Secure Profile automatically turns off this feature. Verify that no workarounds are currently in place. Ensure that only authorized internal networks can access development instances. Review firewall rules to block external access to debugging ports. Test changes in a non-production environment first. Back up configuration files before making adjustments.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Adobe

• Disable Remote Development Services on all production ColdFusion servers.
• Switch Adobe ColdFusion to the Production Secure Profile.
• Review the Adobe ColdFusion Lockdown Guide for specific steps.
• Monitor network traffic for unauthorized file access attempts.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Adobe ColdFusion versions are affected by CVE-2026-90530?

Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13 are affected.

Does exploiting this vulnerability require authentication?

No, exploitation of this issue does not require user interaction or authentication.

How can organizations disable RDS in ColdFusion?

Switching ColdFusion to Production Secure Profile automatically disables RDS.