Critical Adobe ColdFusion Vulnerabilities Allow Attackers to Execute Arbitrary Code

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Spread the love

Adobe has issued critical security updates for ColdFusion 2025 and ColdFusion 2023, addressing multiple vulnerabilities that could allow threat actors to execute arbitrary code, bypass security controls, escalate privileges, expose sensitive memory, or disrupt application availability.

Given the potential impact across enterprise web infrastructure, Adobe has designated this update cycle as urgent.

Adobe ColdFusion Flaws Enable Code Execution

The most alarming flaw resolved in this batch is CVE-2026-48362, an unauthenticated OS command injection vulnerability with a maximum CVSS base score of 10.0.

The flaw allows remote, unauthenticated attackers to execute arbitrary operating system commands on vulnerable ColdFusion servers without any user interaction.

On internet-exposed servers, this grants attackers an immediate path to full host takeover. In addition to command injection, Adobe resolved CVE-2026-48273, an eval injection flaw rated 9.9 on the CVSS scale.

Although exploiting this bug requires low-level privileges, an authenticated user could still leverage it to run arbitrary code. Another critical fix addresses CVE-2026-48440 (CVSS 8.1), a heap-based buffer overflow that opens additional execution vectors.

Addressing these critical Adobe vulnerabilities is essential for preventing host compromise across public web services.

The update resolves multiple authorization and access control errors, including CVE-2026-71384 (CVSS 9.6) and CVE-2026-71387 (CVSS 8.8), which can lead to application denial-of-service, privilege escalation, and arbitrary code execution.

Other authorization fixes include CVE-2026-71385, CVE-2026-25652, and CVE-2026-71383.

As detailed in Adobe Security Bulletin APSB26-90, Adobe issued updates across supported ColdFusion platforms to remediate these flaws.

The release also mitigates CVE-2026-71386 (CVSS 8.8), a cross-site scripting (XSS) vulnerability that can trigger code execution upon user interaction.

Additional fixes address systemic cryptographic and input validation risks:

  • Hard-Coded Cryptographic Key (CVE-2026-34635): Fixes key management flaws that could compromise data protection.
  • Risky Cryptographic Algorithm (CVE-2026-48386): Resolves algorithm weaknesses that expose sensitive system memory.
  • Improper Input Validation (CVE-2026-21279): Binds input bounds checks to prevent unexpected execution states.

Remediating these arbitrary code execution flaws prevents threat actors from pivoting through enterprise applications.

CVE Identifier Vulnerability Type CVSS Score Impact / Exploitation Prerequisite
CVE-2026-48362 OS Command Injection 10.0 Remote unauthenticated arbitrary code execution
CVE-2026-48273 Eval Injection 9.9 Authenticated arbitrary code execution (low privilege)
CVE-2026-71384 Incorrect Authorization 9.6 Application Denial-of-Service (DoS)
CVE-2026-71387 Incorrect Authorization 8.8 Arbitrary code execution / Security bypass
CVE-2026-71386 Cross-Site Scripting (XSS) 8.8 User interaction leading to code execution
CVE-2026-48440 Heap-based Buffer Overflow 8.1 Arbitrary code execution under specific conditions

Adobe reports no active exploitation of these ColdFusion vulnerabilities in the wild. However, given the presence of unauthenticated RCE primitives, administrators must not delay applying Adobe security updates.

  • Apply Software Patches: Upgrade ColdFusion 2025 to version 2025.0.12 and ColdFusion 2023 to version 2023.0.23.
  • Restrict Administrative Portals: Ensure ColdFusion administrative interfaces are isolated from direct public internet exposure.
  • Audit Server Logs: Inspect execution and web logs for anomalous OS commands, unusual process spawns, or unauthorized authentication patterns.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model -> Register Now

The post Critical Adobe ColdFusion Vulnerabilities Allow Attackers to Execute Arbitrary Code appeared first on Cyber Security News.