Critical Adobe ColdFusion flaws let attackers run arbitrary code

Key Takeaways

• Adobe has released urgent security updates for ColdFusion 2025 and 2023.
• Multiple critical vulnerabilities exist, including an unauthenticated OS command injection (CVSS 10.0).
• These flaws could allow attackers to execute arbitrary code, bypass security, and escalate privileges.
• Patches are available and should be applied immediately to prevent host takeover.

Adobe has issued critical security updates for its ColdFusion platform, specifically targeting versions 2025 and 2023. These patches address a range of vulnerabilities that could enable threat actors to achieve arbitrary code execution, circumvent security measures, elevate privileges, expose sensitive memory, or disrupt application availability.

The vendor has emphasized the urgency of these updates, underscoring the potential for significant impact on enterprise web infrastructure if left unaddressed.

Critical ColdFusion Vulnerabilities Uncovered

Among the most severe issues resolved is CVE-2026-48362, an unauthenticated OS command injection vulnerability. This flaw carries the maximum CVSS base score of 10.0, indicating its extreme severity.

Remote Code Execution Risks

This critical vulnerability permits remote attackers to execute arbitrary operating system commands on susceptible ColdFusion servers without requiring any authentication or user interaction. For servers exposed to the internet, this vulnerability presents a direct pathway for attackers to gain full control of the host system.

Additionally, Adobe addressed CVE-2026-48273, an eval injection vulnerability with a CVSS score of 9.9. While exploiting this flaw necessitates low-level privileges, an authenticated user could still leverage it to execute arbitrary code. Another significant fix targets CVE-2026-48440 (CVSS 8.1), a heap-based buffer overflow that could open further avenues for code execution.

Promptly patching these critical Adobe vulnerabilities is paramount for safeguarding public web services against host compromise.

Authorization and Access Control Bypass

The updates also resolve several authorization and access control flaws, including CVE-2026-71384 (CVSS 9.6) and CVE-2026-71387 (CVSS 8.8). These vulnerabilities could lead to application denial-of-service, privilege escalation, and arbitrary code execution. Other authorization-related fixes include CVE-2026-71385, CVE-2026-25652, and CVE-2026-71383.

As detailed in Adobe Security Bulletin APSB26-90, Adobe has rolled out updates across all supported ColdFusion platforms to remediate these issues. The release also addresses CVE-2026-71386 (CVSS 8.8), a cross-site scripting (XSS) vulnerability that could result in code execution following user interaction.

Systemic Cryptographic and Input Validation Risks

Further fixes target underlying cryptographic and input validation weaknesses:

• Hard-Coded Cryptographic Key (CVE-2026-34635): This resolves issues with key management that could compromise data security.
• Risky Cryptographic Algorithm (CVE-2026-48386): Addresses algorithmic vulnerabilities that could expose sensitive system memory.
• Improper Input Validation (CVE-2026-21279): Enhances input bounds checks to prevent unexpected execution states.

Remediating these arbitrary code execution flaws is vital to prevent threat actors from exploiting enterprise applications.

Adobe states there is currently no evidence of these ColdFusion vulnerabilities being actively exploited in the wild. Nevertheless, given the existence of unauthenticated remote code execution primitives, administrators are strongly advised to apply these security updates without delay.

What You Should Do

• Apply Software Patches: Upgrade ColdFusion 2025 to version 2025.0.12 and ColdFusion 2023 to version 2023.0.23 immediately.
• Restrict Administrative Portals: Ensure ColdFusion administrative interfaces are not directly exposed to the public internet.
• Audit Server Logs: Regularly review execution and web logs for any suspicious OS commands, unusual process creations, or unauthorized authentication attempts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.