CVE-2026-105900
7.5HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-20
Impact
Remote, unauthenticated attackers can crash Adobe ColdFusion and cause a denial of service over the network. No privileges or user interaction are required.
Root cause
Improper input validation in ColdFusion allows malformed requests to trigger an application crash.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Review the vendor advisory at apsb26-144.html to identify the target fixed release, and restrict network access to ColdFusion ports via firewall or reverse proxy if patching must wait.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.