As cited
Copy frozen at (site build).
vulnerabilities
NCSC-2026-0435 Vulnerabilities fixed in Adobe ColdFusion
Adobe patched multiple vulnerabilities in ColdFusion, including Server-Side Request Forgery (SSRF), incorrect authorization, improper input validation, code injection, XML External Entity (XXE), uncontrolled resource consumption, and path traversal. Attackers could exploit these flaws to escalate privileges, execute arbitrary code, upload files without restrictions, access internal resources, leak sensitive memory information, or cause denial of service. The path traversal vulnerability in Remote Development Services (RDS) allows reading arbitrary files without user interaction, though RDS is disabled by default in the Production Secure Profile.
Why it matters: ColdFusion administrators and development teams should apply patches immediately to prevent privilege escalation, remote code execution, and unauthorized access to internal systems and sensitive data.
- Source published
- First seen by Cybersecurity Tracker