PatchSiren cyber security CVE debrief

CVE-2026-90530 Adobe CVE debrief

The CVE record for CVE-2026-90530 was published on 2026-10-13T20:21:35.953Z. This CRITICAL vulnerability, with a CVSS score of 9.3, affects ColdFusion RDS and allows for arbitrary file system reads due to an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability (CWE-22). The vulnerability could lead to unauthorized access and data breaches. Defenders and administrators of ColdFusion 2025 and 2023 installations should assess exposure and prioritize mitigation. RDS is a development feature meant for debugging purposes and is disabled in Production Secure Profile. The Lockdown Guide provides steps to disable RDS if a ColdFusion server is not in  

Vendor: Adobe
Product: ColdFusion 2025
CVSS: CRITICAL 9.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-13
Original CVE updated: 2026-10-14
Advisory published: 2026-10-13
Advisory updated: 2026-10-14

Who should care

Defenders and administrators of ColdFusion 2025 and 2023 installations should assess exposure and prioritize mitigation, as RDS is a development feature that can be disabled in Production Secure Profile. This CRITICAL vulnerability allows for arbitrary file system reads, potentially leading to unauthorized access and data breaches.  Defenders should prioritize verifying and mitigating this vulnerability. 

Why it matters

This CRITICAL vulnerability in ColdFusion allows for arbitrary file system reads, potentially leading to unauthorized access and data breaches. Defenders should prioritize verifying and mitigating this vulnerability, especially for ColdFusion 2025 and 2023 installations.

Potential unauthorized access to sensitive files and directories
Possible data breaches due to arbitrary file system reads
Need for verification of affected versions and scope
Priority for updating to unaffected versions or implementing mitigations

Technical summary

ColdFusion RDS is affected by a Path Traversal vulnerability (CWE-22) that could lead to arbitrary file system reads. The vulnerability has a CVSS score of 9.3 and is considered CRITICAL. The vulnerability allows an attacker to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS.  Defenders should prioritize verifying and mitigating this vulnerability, especially for ColdFusion 2025 and 2023 installations.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially for ColdFusion 2025 and 2023 installations, as it allows for arbitrary file system reads.

Recommended defensive actions

Verify ColdFusion installations for RDS exposure
Disable RDS if not in use
Update to unaffected versions (2025.0.14 or 2023.0.26)
Review and implement mitigations from Adobe's Lockdown Guide
Perform vulnerability scanning to identify potentially exposed systems
Implement compensating controls for exposed systems
Monitor relevant logs for suspicious activity

Evidence notes

The CVE record and source item provide details on the vulnerability. Additional verification is needed to confirm affected versions and scope. Defenders should verify ColdFusion installations for RDS exposure, disable RDS if not in use, and update to unaffected versions (2025.0.14 or 2023.0.26). Review and implement mitigations from Adobe's Lockdown Guide. The vulnerability allows for arbitrary file system reads, potentially leading to unauthorized access and data breaches.

Sources and references

Verified primary and authoritative sources

CVE-2026-90530 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-90530

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-90530 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-90530

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/90xxx/CVE-2026-90530.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html

Supplemental source - vendor-advisory
Source reference
Unverified legacy reference

URL: https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/installing-the-server-configuration.html

Supplemental source - mitigation
Source reference
Unverified legacy reference

URL: https://guides.adobe.com/coldfusion/en/docs/coldfusion-tools/security-remote-development-services-rds.html

Supplemental source - mitigation
Source reference
Unverified legacy reference

URL: https://helpx.adobe.com/coldfusion/configuring-administering/administering-coldfusion-security.html

Supplemental source - mitigation
Source reference
Unverified legacy reference

URL: https://www.adobe.com/cc-shared/assets/pdf/products/coldfusion-family/coldfusion-2025-lockdown-guide-1-1.pdf

Supplemental source - mitigation
Source reference
Unverified legacy reference

URL: https://www.stigviewer.com/stigs/adobe_coldfusion/2026-05-13/finding/V-279042

Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.