Quick answers
- Is CVE-2026-105903 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105903 being exploited in the wild.
- How severe is CVE-2026-105903?
- Critical severity, with a CVSS score of 9.9, published 13 October 2026.
- Which products and versions are affected?
- Adobe ColdFusion 2025.0.13, 2023.0.25.
- Is there a fix for CVE-2026-105903?
- Yes: fixed in ColdFusion 2025.0.14, 2023.0.26. Until then: Configure ColdFusion's serial filter as documented in the official KB article to prevent insecure deserialization attacks, and ensure the latest MySQL Java connector is deployed as part of the mitigation strategy. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-105903 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-105903?
- Check whether you run Adobe ColdFusion at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: ColdFusion 2025.0.14, 2023.0.26
Configure ColdFusion's serial filter as documented in the official KB article to prevent insecure deserialization attacks, and ensure the latest MySQL Java connector is deployed as part of the mitigation strategy.
Technical details
CVE-2026-105903 is a code injection flaw (CWE-94) in ColdFusion's improper control of dynamic code generation, allowing low-privileged authenticated attackers to inject and execute arbitrary code over the network without user interaction. The scope is changed (impacts resources beyond the vulnerable component), resulting in complete system compromise including confidentiality, integrity, and availability impacts.
Affected products
- Adobe ColdFusion 2025.0.13, 2023.0.25
Timeline
- 2026-10-13: disclosed