Adobe has issued critical security updates for ColdFusion 2025 and ColdFusion 2023, addressing multiple vulnerabilities that could allow threat actors to execute arbitrary code, bypass security controls, escalate privileges, expose sensitive memory, or disrupt application availability.
Given the potential impact across enterprise web infrastructure, Adobe has designated this update cycle as urgent.
Adobe ColdFusion Flaws Enable Code Execution
The most alarming flaw resolved in this batch is CVE-2026-48362, an unauthenticated OS command injection vulnerability with a maximum CVSS base score of 10.0.
The flaw allows remote, unauthenticated attackers to execute arbitrary operating system commands on vulnerable ColdFusion servers without any user interaction.
On internet-exposed servers, this grants attackers an immediate path to full host takeover. In addition to command injection, Adobe resolved CVE-2026-48273, an eval injection flaw rated 9.9 on the CVSS scale.
Although exploiting this bug requires low-level privileges, an authenticated user could still leverage it to run arbitrary code. Another critical fix addresses CVE-2026-48440 (CVSS 8.1), a heap-based buffer overflow that opens additional execution vectors.
Addressing these critical Adobe vulnerabilities is essential for preventing host compromise across public web services.
The update resolves multiple authorization and access control errors, including CVE-2026-71384 (CVSS 9.6) and CVE-2026-71387 (CVSS 8.8), which can lead to application denial-of-service, privilege escalation, and arbitrary code execution.
Other authorization fixes include CVE-2026-71385, CVE-2026-25652, and CVE-2026-71383.
As detailed in Adobe Security Bulletin APSB26-90, Adobe issued updates across supported ColdFusion platforms to remediate these flaws.
The release also mitigates CVE-2026-71386 (CVSS 8.8), a cross-site scripting (XSS) vulnerability that can trigger code execution upon user interaction.
Additional fixes address systemic cryptographic and input validation risks:
Hard-Coded Cryptographic Key (CVE-2026-34635): Fixes key management flaws that could compromise data protection.
Risky Cryptographic Algorithm (CVE-2026-48386): Resolves algorithm weaknesses that expose sensitive system memory.
Improper Input Validation (CVE-2026-21279): Binds input bounds checks to prevent unexpected execution states.
Remediating these arbitrary code execution flaws prevents threat actors from pivoting through enterprise applications.
CVE IdentifierVulnerability TypeCVSS ScoreImpact / Exploitation PrerequisiteCVE-2026-48362OS Command Injection10.0Remote unauthenticated arbitrary code executionCVE-2026-48273Eval Injection9.9Authenticated arbitrary code execution (low privilege)CVE-2026-71384Incorrect Authorization9.6Application Denial-of-Service (DoS)CVE-2026-71387Incorrect Authorization8.8Arbitrary code execution / Security bypassCVE-2026-71386Cross-Site Scripting (XSS)8.8User interaction leading to code executionCVE-2026-48440Heap-based Buffer Overflow8.1Arbitrary code execution under specific conditions
Adobe reports no active exploitation of these ColdFusion vulnerabilities in the wild. However, given the presence of unauthenticated RCE primitives, administrators must not delay applying Adobe security updates.
Apply Software Patches: Upgrade ColdFusion 2025 to version 2025.0.12 and ColdFusion 2023 to version 2023.0.23.
Restrict Administrative Portals: Ensure ColdFusion administrative interfaces are isolated from direct public internet exposure.
Audit Server Logs: Inspect execution and web logs for anomalous OS commands, unusual process spawns, or unauthorized authentication patterns.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model -> Register Now
The post Critical Adobe ColdFusion Vulnerabilities Allow Attackers to Execute Arbitrary Code appeared first on Cyber Security News.
