EXPOSURES › CVE-2026-105903
CVE-2026-105903
CRITICALColdFusion suffers from a critical code injection flaw allowing arbitrary code execution without user interaction.
A low-privileged attacker can execute arbitrary code in the context of the current user without requiring user interaction, enabling remote code execution. DIB organizations must patch ColdFusion immediately to prevent compromise of their applications and systems.
Shame score — A critical CVSS 9.9 code injection vulnerability allows arbitrary code execution without user interaction, representing a severe avoidable risk for any organization running ColdFusion.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.