CVE-2026-90530

9.3Critical

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

9.3Critical

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-22

Impact

Attackers can read arbitrary files and directories on the host without authentication or user interaction. They require local access to exploit the vulnerable RDS service.

Root cause

Improper limitation of a pathname allows path traversal inside ColdFusion Remote Development Services (RDS).

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade to the patched version referenced in advisory apsb26-144, or immediately disable ColdFusion RDS by enabling the Production Secure Profile or disabling RDS manually via the ColdFusion Administrator.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-90530