CVE-2026-105903: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Adobe ColdFusion 2025

CVE-2026-105903 is an improper control of code generation (CWE-94) vulnerability in Adobe ColdFusion 2025. It enables an attacker with low privileges to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The CVSS 3.1 score is 9.9, indicating critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The scope of the vulnerability is changed, meaning the impact extends beyond the vulnerable component.

Successful exploitation allows arbitrary code execution with the privileges of the current user, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. Since the attacker requires only low privileges and no user interaction, the risk is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to ColdFusion services and monitor for suspicious activity related to code execution attempts.