External risk intelligence

ColdFusion Code Injection Vulnerability Allows Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-105903

ColdFusion is a commercial application server platform typically deployed to host web applications and public-facing APIs. These services are commonly positioned at the network edge or in accessible tiers to serve external traffic, making them likely to be reachable from the internet in standard deployment patterns.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical security vulnerability in ColdFusion, a platform used for web applications. The issue could allow unauthorized users to execute malicious code, potentially impacting the applications and data hosted on affected systems. The main concern is confirming whether your ColdFusion instances are exposed and require attention.

A flaw lets attackers run harmful code.
It affects web applications hosted on ColdFusion.
Assess potential exposure and relevance.

Attack Path

How an attacker could exploit the issue

A low-privileged attacker could leverage this vulnerability by reaching a vulnerable component in ColdFusion over the network without needing user interaction. Successful exploitation could allow the attacker to execute arbitrary code with the privileges of the current user.

Attacker can reach vulnerable code remotely.
No user interaction needed to trigger.
Arbitrary code execution in user context.

Live Threat

Current exploitation, exposure, and threat context

A code injection vulnerability in ColdFusion could allow a low-privileged attacker to execute arbitrary code on the affected system without user interaction. This could lead to unauthorized operations within the context of the current user.

System code execution is at risk.
Arbitrary code injection could occur.
Unauthorized code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This code injection vulnerability in ColdFusion requires immediate attention from teams managing application infrastructure and public-facing web services. The first practical step is to inventory all ColdFusion deployments, determine their internet-facing exposure and business criticality, and identify the accountable application or platform owners. Remediation planning should then be prioritized based on assessed risk.

Application and platform teams own remediation.
Verify external reachability and business criticality.
Plan and coordinate targeted updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ColdFusion?

ColdFusion is a commercial application server platform used by developers to build, deploy, and host dynamic web applications and public-facing APIs. It acts as a middle-tier environment that processes server-side scripts to generate content for users. Because it serves as the backbone for these applications, it is frequently placed in network tiers where it must handle incoming web traffic.

What does Code Injection mean for CVE-2026-105903?

This vulnerability is classified as Improper Control of Generation of Code (CWE-94). In simple terms, it means the application fails to properly filter or handle input, allowing an attacker to insert and execute their own unauthorized commands. When successful, the system essentially follows the attacker's instructions instead of just the intended application logic, leading to arbitrary code execution.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted requests over the network to the vulnerable ColdFusion component. A key characteristic of this flaw is that it does not require any interaction from a legitimate user to succeed. While the attacker needs low-level privileges to initiate the attempt, they do not need to trick anyone into clicking a link or performing an action to gain control.

Is my ColdFusion instance at risk?

According to Halo Surface Signal, ColdFusion is often deployed to host web services and APIs directly at the network edge to serve external requests. Because it is frequently exposed to the internet, many instances are considered reachable by unauthorized parties. You should evaluate whether your specific deployments are internet-facing or positioned in a way that allows external network access.

What should I do first to address this CVE?

Start by identifying every ColdFusion instance within your environment. Create an inventory that documents where each server is located and whether it is accessible from the internet. Once you have a clear list, coordinate with the specific owners of those applications to prioritize them based on their business importance and external exposure. This preparation allows you to plan your update process effectively.

References

www.adobe.com/trust/security/products/coldfusion/apsb26-144.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.