Adobe has released critical security updates for ColdFusion 2025 and ColdFusion 2023, addressing multiple vulnerabilities that could allow attackers to execute arbitrary code, bypass security controls, escalate privileges, expose sensitive memory, or disrupt application availability.
Given the potential impact on enterprise web infrastructure, Adobe has designated the update cycle as urgent.
Adobe ColdFusion Flaws Enable Code Execution
The most severe vulnerability addressed in this update is CVE-2026-48362, an unauthenticated OS command injection flaw with a maximum CVSS score of 10.0.
The vulnerability allows remote, unauthenticated attackers to execute arbitrary operating system commands on vulnerable ColdFusion servers without user interaction.
On internet-facing servers, successful exploitation could provide attackers with a direct path to full host compromise.
Adobe also addressed CVE-2026-48273, an eval injection vulnerability rated CVSS 9.9. Although exploitation requires low-level privileges, an authenticated attacker could leverage the flaw to execute arbitrary code.
Another critical issue, CVE-2026-48440 (CVSS 8.1), is a heap-based buffer overflow that could provide additional code-execution opportunities under specific conditions.
The vulnerabilities are detailed in Adobe Security Bulletin APSB26-90.
Additional Authorization and Security Flaws
The update also resolves several authorization and access-control vulnerabilities, including:
- CVE-2026-71384 (CVSS 9.6): Incorrect authorization that can result in application denial-of-service.
- CVE-2026-71387 (CVSS 8.8): Incorrect authorization potentially leading to arbitrary code execution and security bypass.
- CVE-2026-71386 (CVSS 8.8): Cross-site scripting vulnerability that can lead to code execution following user interaction.
- CVE-2026-71385: Authorization vulnerability.
- CVE-2026-25652: Authorization-related security flaw.
- CVE-2026-71383: Additional authorization vulnerability.
Adobe also fixed several underlying cryptographic and input-validation weaknesses:
- CVE-2026-34635: Hard-coded cryptographic key vulnerability that could weaken data protection.
- CVE-2026-48386: Risky cryptographic algorithm that could expose sensitive system memory.
- CVE-2026-21279: Improper input validation that could result in unexpected execution states.
Critical ColdFusion Vulnerabilities
| CVE | Vulnerability | CVSS | Potential Impact |
|---|---|---|---|
| CVE-2026-48362 | OS Command Injection | 10.0 | Remote unauthenticated arbitrary code execution |
| CVE-2026-48273 | Eval Injection | 9.9 | Authenticated arbitrary code execution |
| CVE-2026-71384 | Incorrect Authorization | 9.6 | Application denial-of-service |
| CVE-2026-71387 | Incorrect Authorization | 8.8 | Code execution / security bypass |
| CVE-2026-71386 | Cross-Site Scripting | 8.8 | Code execution after user interaction |
| CVE-2026-48440 | Heap-Based Buffer Overflow | 8.1 | Potential arbitrary code execution |
Affected Versions
Adobe has released updates for the supported ColdFusion branches:
- ColdFusion 2025: Upgrade to 2025.0.12
- ColdFusion 2023: Upgrade to 2023.0.23
Adobe currently reports no known active exploitation of these vulnerabilities in the wild.
However, the presence of a CVSS 10.0 unauthenticated OS command injection vulnerability makes exposed ColdFusion deployments a high-priority patching target.
Recommended Actions
Organizations running ColdFusion should take the following steps:
- Apply the security updates immediately.
- Restrict ColdFusion administrative interfaces and prevent unnecessary direct exposure to the public internet.
- Review web and application logs for suspicious requests, unexpected OS command execution, and unusual process creation.
- Monitor authentication activity for abnormal or unauthorized access.
- Review internet-facing ColdFusion servers and prioritize externally accessible systems for emergency patching.
- Investigate potentially compromised systems before applying remediation if suspicious activity is detected.
Conclusion
The combination of unauthenticated remote command injection, eval injection, authorization bypasses, and memory corruption vulnerabilities makes this ColdFusion update particularly important for enterprise environments.
While Adobe has not reported active exploitation, organizations should treat CVE-2026-48362 as an emergency patching priority, especially when ColdFusion servers are directly accessible from the internet.
