# CVE-2026-90530: Adobe ColdFusion RDS path traversal arbitrary file read

Source: https://junglewise.ai/threats/cve-2026-90530-coldfusion-rds-is-affected-by-an-improper-limitation-of-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-90530 · Severity: critical · CVSS 9.3 · Published 2026-10-13

Adobe ColdFusion's Remote Development Services (RDS) is a debugging tool that lets developers remotely access a ColdFusion server's files and databases. A path traversal vulnerability in RDS allows an attacker to read arbitrary files on the server without authentication, potentially exposing sensitive application code, configuration data, and credentials. This could lead to complete server compromise or data theft.

Technologies: [Adobe ColdFusion](https://junglewise.ai/threats/technologies/coldfusion). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-90530 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90530 being exploited in the wild.

**How severe is CVE-2026-90530?** Critical severity, with a CVSS score of 9.3, published 13 October 2026.

**Which products and versions are affected?** Adobe ColdFusion.

**Is there a fix for CVE-2026-90530?** No fixed version is recorded yet. Disable RDS in the ColdFusion Administrator under Security > RDS by unchecking "Enable RDS Service". ColdFusion servers installed with the Production Secure Profile have RDS disabled by default; development servers should be switched to Production mode or RDS should be manually disabled and restricted to trusted networks only. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90530 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90530?** Check whether you run Adobe ColdFusion. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable RDS in the ColdFusion Administrator under Security > RDS by unchecking "Enable RDS Service". ColdFusion servers installed with the Production Secure Profile have RDS disabled by default; development servers should be switched to Production mode or RDS should be manually disabled and restricted to trusted networks only.

## Technical details

An improper pathname validation flaw in ColdFusion's RDS component allows a remote, unauthenticated attacker to traverse directory structures and read files outside the intended scope via crafted requests. The vulnerability requires network access to the RDS service but no user interaction or authentication. An attacker gains unrestricted read access to the server's file system, including sensitive files stored in restricted directories.

## Affected products

- Adobe ColdFusion

## Timeline

- 2026-10-13: disclosed

## References

- [https://guides.adobe.com/coldfusion/en/docs/coldfusion-tools/security-remote-development-services-rds.html](https://guides.adobe.com/coldfusion/en/docs/coldfusion-tools/security-remote-development-services-rds.html)
- [https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/installing-the-server-configuration.html](https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/installing-the-server-configuration.html)

## Related threats

- [Adobe ColdFusion server-side request forgery privilege escalation](https://junglewise.ai/threats/cve-2026-76001-coldfusion-is-affected-by-a-server-side-request-forgery-ssrf)
- [Adobe ColdFusion uncontrolled resource consumption denial-of-service](https://junglewise.ai/threats/cve-2026-75996-coldfusion-is-affected-by-an-uncontrolled-resource-consumption)
- [Adobe ColdFusion improper input validation in administrative component](https://junglewise.ai/threats/cve-2026-75995-coldfusion-is-affected-by-an-improper-input-validation)
- [Adobe ColdFusion server-side request forgery privilege escalation](https://junglewise.ai/threats/cve-2026-75748-coldfusion-is-affected-by-a-server-side-request-forgery-ssrf)
- [Adobe ColdFusion incorrect authorization arbitrary code execution](https://junglewise.ai/threats/cve-2026-71385-coldfusion-is-affected-by-an-incorrect-authorization)