Adobe ColdFusion 2025 and 2023 contain a critical code injection flaw (CVSS 9.9) that lets a low-privileged attacker run arbitrary code over the network without any user interaction.
What Is It
CVE-2026-105903 is an Improper Control of Generation of Code ("Code Injection") vulnerability, CWE-94, in Adobe ColdFusion. Adobe's description says successful exploitation can lead to arbitrary code execution in the context of the current user. An attacker needs only low privileges, and exploitation does not require user interaction.
Adobe PSIRT reported the flaw. NVD published it on October 13, 2026. Its NVD status is currently "Received," which means NVD has not finished its own analysis yet.
Why It Matters
Adobe scores this vulnerability 9.9 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In practice:
- Network-reachable: an attacker can exploit it remotely.
- Low attack complexity: no special conditions are needed.
- Low privileges required: any authenticated low-privilege account may be enough.
- No user interaction: no victim has to click anything.
- Scope changed: the impact can reach beyond the vulnerable component.
- High impact: confidentiality, integrity and availability are all rated high.
Exploitation status: CVE-2026-105903 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not currently confirm active exploitation. The sources cited here do not establish whether the flaw is being exploited in the wild.
What's Vulnerable
According to Adobe's affected-version data in the NVD record:
| Product | Affected | Fixed |
|---|---|---|
| ColdFusion 2025 | 2025.0.13 and earlier | 2025.0.14 |
| ColdFusion 2023 | 2023.0.25 and earlier | 2023.0.26 |
The NVD record does not yet list any CPEs.
Patch Status
Adobe has published security bulletin APSB26-144 for ColdFusion. Based on the version data, the fixed releases are:
- ColdFusion 2025: update to 2025.0.14 or later
- ColdFusion 2023: update to 2023.0.26 or later
There is no CISA KEV entry, so no federal required action or due date applies. Because of the critical score and the low barrier to exploitation, administrators should apply the APSB26-144 updates promptly. Adobe's bulletin has the full installation guidance. Adobe normally publishes its security bulletins under helpx.adobe.com/security/products/. If one bulletin link below does not load, use the other.