Adobe ColdFusion Critical Flaws Allow Code Execution
Summary
CERT-Bund published security advisory WID-SEC-2026-1110 alerting to multiple critical vulnerabilities in Adobe ColdFusion 2023 (prior to Update 19) and Adobe ColdFusion 2025 (prior to Update 7). The vulnerabilities carry a CVSS Base Score of 9.3 (critical) and temporal score of 8.1 (high). An unauthenticated remote attacker can exploit these flaws to execute arbitrary code, bypass security controls, disclose information, and conduct denial of service attacks. Mitigation measures are available.
What changed
Multiple critical vulnerabilities (CVSS Base Score 9.3) affect Adobe ColdFusion 2023 prior to Update 19 and Adobe ColdFusion 2025 prior to Update 7. These flaws enable remote unauthenticated attackers to execute arbitrary code, bypass security controls, disclose sensitive information, and launch denial of service attacks.
Organizations running affected ColdFusion versions should apply available updates immediately. No workarounds are documented. Failure to patch exposes systems to complete compromise, data breach, and service disruption. Security teams should audit ColdFusion deployments and prioritize patching given the critical severity and remote exploit capability.
What to do next
- Update Adobe ColdFusion 2023 to Update 19 or later
- Update Adobe ColdFusion 2025 to Update 7 or later
- Review CERT-Bund mitigation guidance
Archived snapshot
Apr 15, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1110] Adobe ColdFusion: Mehrere Schwachstellen CVSS Base Score 9.3 (kritisch) CVSS Temporal Score 8.1 (hoch) Remoteangriff ja Datum 14.04.2026 Stand 15.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Linux
- UNIX
- Windows
Produktbeschreibung
ColdFusion ist ein Applikationsserver sowie Framework zur Erstellung von Web basierten Applikationen.
Produkte
14.04.2026
- Adobe ColdFusion 2025 <Update 7
- Adobe ColdFusion 2023 <Update 19
Angriff
Angriff
Ein Angreifer kann mehrere Schwachstellen in Adobe ColdFusion ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.