Critical Adobe ColdFusion Vulnerabilities Enable Widespread Code Execution

Adobe has issued critical security updates for its ColdFusion 2025 and 2023 platforms, addressing a suite of vulnerabilities that could allow threat actors to execute arbitrary code, escalate privileges, and disrupt application availability. The urgency of these patches stems from the potential for widespread compromise across enterprise web infrastructure.

The most severe flaw, identified as CVE-2026-48362, is an unauthenticated OS command injection vulnerability with a maximum CVSS base score of 10.0. This critical vulnerability permits remote, unauthenticated attackers to execute arbitrary operating system commands on vulnerable ColdFusion servers without any user interaction, providing a direct path to full host takeover on internet-exposed systems.

In addition to the command injection flaw, Adobe has resolved CVE-2026-48273, an eval injection vulnerability rated CVSS 9.9. While exploiting this bug requires low-level privileges, an authenticated user could leverage it to achieve arbitrary code execution, posing a significant risk to internal systems.

Further compounding the risk, CVE-2026-48440, a heap-based buffer overflow vulnerability with a CVSS score of 8.1, has also been patched. This flaw introduces additional vectors for arbitrary code execution under specific conditions.

The update also addresses several authorization and access control vulnerabilities, including CVE-2026-71384 (CVSS 9.6) and CVE-2026-71387 (CVSS 8.8). These flaws can lead to application denial-of-service, privilege escalation, and arbitrary code execution, further broadening the attack surface.

Adobe's security bulletin APSB26-90 details fixes for these and other issues, including CVE-2026-71386 (CVSS 8.8), a cross-site scripting (XSS) vulnerability that could lead to code execution with user interaction. Systemic risks related to hard-coded cryptographic keys (CVE-2026-34635), risky cryptographic algorithms (CVE-2026-48386), and improper input validation (CVE-2026-21279) have also been mitigated.

While Adobe reports no active exploitation of these specific ColdFusion vulnerabilities in the wild, the presence of unauthenticated remote code execution primitives necessitates immediate action. Administrators are strongly advised to upgrade ColdFusion 2025 to version 2025.0.12 and ColdFusion 2023 to version 2023.0.23. Additional recommended security practices include restricting access to administrative portals and diligently auditing server logs for anomalous activity.