Is CVE-2026-90530 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90530 being exploited in the wild.

How severe is CVE-2026-90530?

Critical severity, with a CVSS score of 9.3, published 13 October 2026.

How is CVE-2026-90530 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90530?

Check whether you run Adobe ColdFusion. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90530: Adobe ColdFusion RDS path traversal arbitrary file read

CVE-2026-90530 · Severity: critical · CVSS 9.3 · Published 2026-10-13

Adobe ColdFusion's Remote Development Services (RDS) is a debugging tool that lets developers remotely access a ColdFusion server's files and databases. A path traversal vulnerability in RDS allows an attacker to read arbitrary files on the server without authentication, potentially exposing sensitive application code, configuration data, and credentials. This could lead to complete server compromise or data theft.

Technologies: Adobe ColdFusion. Vendors: Adobe.

Quick answers

Is CVE-2026-90530 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90530 being exploited in the wild.
How severe is CVE-2026-90530?: Critical severity, with a CVSS score of 9.3, published 13 October 2026.
Which products and versions are affected?: Adobe ColdFusion.
Is there a fix for CVE-2026-90530?: No fixed version is recorded yet. Disable RDS in the ColdFusion Administrator under Security > RDS by unchecking "Enable RDS Service". ColdFusion servers installed with the Production Secure Profile have RDS disabled by default; development servers should be switched to Production mode or RDS should be manually disabled and restricted to trusted networks only. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90530 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90530?: Check whether you run Adobe ColdFusion. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable RDS in the ColdFusion Administrator under Security > RDS by unchecking "Enable RDS Service". ColdFusion servers installed with the Production Secure Profile have RDS disabled by default; development servers should be switched to Production mode or RDS should be manually disabled and restricted to trusted networks only.

Technical details

An improper pathname validation flaw in ColdFusion's RDS component allows a remote, unauthenticated attacker to traverse directory structures and read files outside the intended scope via crafted requests. The vulnerability requires network access to the RDS service but no user interaction or authentication. An attacker gains unrestricted read access to the server's file system, including sensitive files stored in restricted directories.

Affected products

Adobe ColdFusion

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.