CVE-2026-105903
9.9CriticalPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-94
Impact
Authenticated attackers with low privileges can execute arbitrary code in the context of the ColdFusion service account and escape scope to impact other system components. They only need network access and valid low-privileged credentials to exploit it without user interaction.
Root cause
Improper control of code generation (code injection) allows input to be directly executed as code.
Affected systems
Adobe ColdFusion (exact versions not listed in the provided data — check vendor advisory APSB26-144).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Apply the update referenced in Adobe advisory APSB26-144; if patching immediately is not feasible, restrict network access to ColdFusion management interfaces and audit low-privileged accounts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.