Adobe has disclosed CVE-2026-90530, a critical-rated (CVSS 9.3) path traversal flaw in ColdFusion's Remote Development Services (RDS). An attacker could use it to read arbitrary files on the server's file system.
What Is It
CVE-2026-90530 is an Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") vulnerability in the ColdFusion RDS component. It is classified as CWE-22. Adobe's description says an attacker could exploit it to reach sensitive files and directories outside the intended access scope, which can lead to arbitrary file system reads. Exploitation does not require user interaction, and the scope is changed.
Adobe notes that RDS is a development feature meant only for debugging.
Why It Matters
Adobe PSIRT scored the flaw 9.3 (CRITICAL) under CVSS 3.1. The scoring reflects low attack complexity, no privileges required, no user interaction, and a changed scope. It lists the attack vector as Local.
The impact Adobe describes is a loss of confidentiality: an attacker can read files outside the intended directory. Adobe's description does not say the flaw lets an attacker modify data or disrupt the service. The published vector still rates integrity and availability impact as high, and the description does not account for those ratings. Defenders should keep this in mind when they rank the issue, at least until NVD finishes its analysis.
The CISA Known Exploited Vulnerabilities (KEV) Catalog has no entry for this CVE, so KEV does not confirm active exploitation at this time. NVD lists the record's status as "Received," which means it has not yet been fully analyzed.
What's Vulnerable
Adobe's affected-product data lists these versions:
- ColdFusion 2025: versions up to and including 2025.0.13 are affected. 2025.0.14 is listed as unaffected.
- ColdFusion 2023: versions up to and including 2023.0.25 are affected. 2023.0.26 is listed as unaffected.
The flaw is in the RDS feature, so a server is only exposed if RDS is enabled on it.
Patch Status
Adobe fixed the issue in security bulletin APSB26-144. Administrators should move to ColdFusion 2025 Update 14 (2025.0.14) or ColdFusion 2023 Update 26 (2023.0.26). These are the first versions Adobe lists as unaffected.
Adobe also gives configuration guidance:
- Switching ColdFusion to the Production Secure Profile disables RDS automatically.
- For servers not running in Production Secure Profile, the ColdFusion Lockdown Guide gives the specific step to disable RDS.
A related DISA STIG finding (V-279042) is also referenced for ColdFusion hardening.
Sources
- Adobe Security Bulletin APSB26-144
- Adobe ColdFusion: Security for Remote Development Services (RDS)
- Adobe ColdFusion: Installing the Server Configuration
- Adobe: Administering ColdFusion Security
- Adobe ColdFusion 2025 Lockdown Guide (PDF)
- STIG Viewer: Adobe ColdFusion Finding V-279042
- NVD: CVE-2026-90530
- CISA Known Exploited Vulnerabilities Catalog