Adobe ColdFusion CVE-2026-90530

Exploitation requires that ColdFusion's RDS (Remote Development Services) feature be ENABLED. RDS is a development/debugging-only service and is automatically DISABLED when the server runs under Production Secure Profile; the ColdFusion Lockdown Guide also directs operators to disable RDS manually when Secure Profile is not used. Therefore the primary limiting factor is deployment mode: default-hardened production servers (Secure Profile on, RDS off) are not exposed, while dev, staging, or legacy servers with RDS left on are vulnerable. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed once RDS is reachable; the practical gate is RDS reachability and the non-default enabled state, not credentials.

Adobe rates this 9.3 Critical via CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, but several signals temper real-world urgency. First, a notable conflict: the vector declares I:H and A:H (full integrity and availability impact), yet the description limits the flaw to 'arbitrary file system read' only - a read primitive does not normally justify I:H/A:H, so the vendor impact metrics appear inflated relative to the described behavior; treat confidentiality as the genuine impact. Second, the vector lists AV:L (local) while RDS (Remote Development Services) is inherently a network-reachable service consumed by remote development tooling, so AV:L likely understates reachability - verify with Adobe whether 'local' reflects a loopback-only default. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so this is 'no public exploit identified at time of analysis' rather than active exploitation. The strongest risk mitigant is operational: RDS is a development/debugging feature that is automatically disabled under ColdFusion's Production Secure Profile and is explicitly recommended for disablement by the Lockdown Guide, so correctly hardened production servers are not exposed. Net: a high-severity read vulnerability whose practical risk is gated almost entirely on whether RDS is left enabled - a real priority for dev/staging or unhardened servers, but low exposure in properly locked-down production.

An attacker who can reach a ColdFusion server with RDS enabled (i.e., not running Production Secure Profile) sends a crafted path-traversal request to the RDS endpoint to read files outside the intended web/application scope, such as ColdFusion configuration files containing datasource credentials, encryption seeds, or other secrets. Exploitation requires no user interaction and, per the PR:N vector, no authentication. No public exploit code was identified at time of analysis.