CVSS 9.3: Unauthenticated Attackers Read Files in Adobe ColdFusion RDS Flaw

Adobe ColdFusion contains a critical security flaw that allows attackers to read arbitrary files on the server. The issue exists in the Remote Development Server (RDS) component, which is a debugging feature. According to the National Vulnerability Database, this path traversal vulnerability is identified as CVE-2026-90530. It enables unauthorized access to sensitive directories outside the intended scope.

The flaw is rated Critical with a CVSS score of 9.3. An attacker can exploit this issue without requiring any user interaction or authentication. This means the server can be accessed directly from the internet if the RDS feature is enabled and exposed. The vulnerability allows for arbitrary file system reads, potentially exposing confidential data stored on the host.

Context for the flaw

The Remote Development Server is designed purely as a development tool for debugging purposes. It is not intended for use in live production environments. The vulnerability is classified under CWE-22, which relates to improper limitation of a pathname to a restricted directory. This weakness allows an attacker to traverse directory structures and access files they should not see.

Who is affected

Adobe ColdFusion 2023 versions up to 2023.0.25 are affected by this vulnerability. Additionally, Adobe ColdFusion 2025 versions up to 2025.0.13 are also vulnerable. Organizations using these specific versions must check if the RDS feature is active. If the feature is running, the server is exposed to this critical risk regardless of other security measures.

Defender's checklist

Switching ColdFusion to the Production Secure Profile automatically disables the RDS feature. This is the primary mitigation step recommended by the vendor. If the server is not using the Production Secure Profile, administrators must manually disable RDS. The Adobe ColdFusion Lockdown Guide outlines the specific steps required to turn off this feature securely.

Operational impact

Organizations should immediately audit their ColdFusion instances to determine if the Remote Development Server is active. Teams usually need to verify that production servers are configured with the Production Secure Profile. If RDS is enabled, it should be disabled as a priority because it is a development tool. Internal communications should alert IT and security teams to the risk of unauthenticated file access. Suppliers providing ColdFusion services must confirm their configurations are hardened against this path traversal flaw.

Background: Unauthorized access

Unauthorized access means any entry into a system, network, or physical space by a person who lacks explicit permission. It occurs when attackers bypass identity verification or exploit misconfigurations. You stop it by enforcing least privilege, monitoring logs for anomalies, and separating administrative duties from daily operations.

Read the full guide: Unauthorized Access Meaning: How Intruders Bypass Controls

What to do and how to stay safe: Adobe ColdFusion

• Verify that your ColdFusion servers are running the Production Secure Profile to automatically disable RDS.
• Manually disable the Remote Development Server if you are not using the Production Secure Profile, following the Lockdown Guide.
• Monitor server logs for unusual file access attempts or requests to the RDS endpoints.
• Update your inventory to identify all servers running vulnerable versions of ColdFusion 2023 and 2025.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-90530?

The CVSS score is 9.3, which is rated as Critical severity.

Which versions of Adobe ColdFusion are affected?

Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13 are affected.

Does exploiting this vulnerability require user interaction?

No, exploitation of this issue does not require user interaction or authentication.