CVE-2026-105903

Summary

ColdFusion contains a code injection vulnerability that allows low-privileged attackers to execute arbitrary code with the privileges of the current user. This critical flaw enables remote code execution without requiring user interaction.

Exploitability

Exploitation is relatively straightforward for low-privileged attackers as it requires no user interaction and can be triggered through vulnerable code generation processes.

Blast radius

The vulnerability could lead to complete system compromise as attackers could execute arbitrary code with the privileges of the ColdFusion service account, potentially enabling lateral movement and data exfiltration across the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ColdFusion 2026.0.0 or later immediately, as this version contains the fix for CVE-2026-105903.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.