Adobe ColdFusion Flaws Allow Remote Code Execution

Adobe has issued a crucial security update to address significant vulnerabilities in ColdFusion 2025 and 2023. These Adobe ColdFusion flaws, rated Priority 1, pose a risk for arbitrary code execution and privilege escalation. Affected versions include ColdFusion 2025 Update 9 and earlier, and ColdFusion 2023 Update 20 and earlier. The company strongly advises users to upgrade to ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21.

The vulnerabilities, which were rated with a CVSS score of 10.0, include dangerous file uploads and improper input validation. These could permit attackers to execute code remotely. Additional threats include a path traversal bug, CVE-2026-48313, which risks exposing system configurations.

Though no current exploitation is reported, Adobe stresses the importance of applying patches promptly. They recommend upgrading Java platforms and applying security configurations. Notably, researchers like Anirudh Anand contributed to uncovering these issues. For complete details, visit the official news article.

Critical Multiple Adobe ColdFusion Vulnerabilities Enables Arbitrary Code Execution Attacks