CVE-2026-105903

Executive Summary

CVE-2026-105903 is a code injection vulnerability (CWE-94) in Adobe ColdFusion that allows a low-privileged, authenticated attacker to execute arbitrary code in the context of the current user. The vulnerability requires no user interaction, is network-reachable, and carries a CVSS v3.1 base score of 9.9 (Critical) due to a changed scope and full impact to confidentiality, integrity, and availability. No public proof-of-concept, exploit code, or Nuclei template exists, and the vulnerability is currently unpatched per tracked sources.

Technical Analysis

The vulnerability is classified as CWE-94: Improper Control of Generation of Code ('Code Injection'). The NVD description states that ColdFusion is affected by this flaw and that successful exploitation results in arbitrary code execution in the context of the current user. The attack vector is network (AV:N), complexity is low (AC:L), and the attacker requires low privileges (PR:L), meaning some form of authenticated access to the application is necessary. No user interaction (UI:N) is required, which elevates the risk for automated exploitation.

The changed scope (S:C) indicates that a successful exploit can affect resources beyond the vulnerable component's security authority — for example, compromising the underlying host or adjacent services rather than remaining confined to the application boundary. The impact subscores are all High (C:H/I:H/A:H), confirming complete compromise of confidentiality, integrity, and availability of affected resources.

Code injection vulnerabilities in ColdFusion-class application servers typically arise when user-controllable input is passed into a dynamic code evaluation or template compilation path without adequate validation or sanitization. However, the provided data does not specify the vulnerable component, endpoint, parameter, or function involved. No specific function names, class names, URL endpoints, file paths, or API parameters are available from the source description. Any such specifics would be speculative and are therefore omitted.

The attack surface is the ColdFusion application server itself, which is commonly internet-exposed for web application delivery and administrative access. Because the flaw allows code execution with only low privileges and no user interaction, it represents a high-value target for initial access and post-exploitation activity.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-94 code injection) and the CVSS metrics provided.

1. Reconnaissance / target identification: An attacker identifies an internet-facing or internally reachable ColdFusion instance. This may be achieved through standard service fingerprinting (HTTP response headers, ColdFusion-specific paths, or the presence of administrative interfaces). No specific endpoint is named in the source data.

2. Triggering the flaw: The attacker, holding low privileges (PR:L — i.e., some authenticated or low-privileged access to the application), supplies crafted input to a ColdFusion component that dynamically generates or evaluates code. Because the vulnerability class is code injection, the attacker's input is incorporated into executed code without sufficient control or sanitization. No user interaction is required (UI:N), so the attacker can trigger the vulnerable path directly.

3. Payload / execution method: At the vulnerability-class level, the injected content is evaluated by the ColdFusion runtime, resulting in arbitrary code execution in the context of the current user. The specific injection syntax, encoding, and delivery mechanism are not described in the available data and are not fabricated here.

4. Post-exploitation impact: Successful exploitation grants arbitrary code execution under the privileges of the ColdFusion process user. Given the changed scope (S:C), the attacker may pivot beyond the application context, potentially affecting the host or connected systems. Full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) is expected, enabling data exfiltration, persistence, lateral movement, and service disruption.

Impact Assessment

CVE-2026-105903 has a CVSS v3.1 base score of 9.9, rated Critical. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates:

• Network exploitability (AV:N) — the flaw can be reached remotely.
• Low attack complexity (AC:L) — no specialized conditions are required.
• Low privileges required (PR:L) — the attacker needs only basic access, not administrative rights.
• No user interaction (UI:N) — exploitation can be fully automated.
• Changed scope (S:C) — impact extends beyond the vulnerable component.
• High confidentiality, integrity, and availability impact (C:H/I:H/A:H).

Business impact includes potential full compromise of ColdFusion-hosted applications and their underlying data, as well as the host operating environment. Affected systems are ColdFusion deployments, which are frequently used for enterprise web applications, internal portals, and integration middleware. Because the flaw permits code execution with low privileges, the blast radius can extend to any resource accessible from the ColdFusion process, including databases, file systems, and adjacent network services. No EPSS score has been assigned by FIRST.org at the time of writing, and CISA KEV does not list this CVE, indicating no confirmed exploitation in the wild within tracked sources.

Detection Guidance

Sigma Rule

title: Potential ColdFusion Code Injection Exploitation Attempt (CVE-2026-105903)
id: 8f2c1a44-9b3e-4d7a-a1c2-5e6f7b8d9c01
status: experimental
description: Detects suspicious code-execution patterns or anomalous child processes spawned by ColdFusion, consistent with CWE-94 code injection exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105903
author: Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\jrun.exe'
      - '\coldfusion.exe'
      - '\httpd.exe'
  selection_suspicious_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\bash'
      - '\sh'
  condition: selection_parent and selection_suspicious_child
falsepositives:
  - Legitimate administrative scripts executed by ColdFusion services
level: high

YARA Rule

rule CVE_2026_105903_ColdFusion_CodeInjection
{
    meta:
        description = "Detects potential code injection artifacts related to CVE-2026-105903 in ColdFusion environments"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105903"
        severity = "critical"

    strings:
        $cf1 = "cfexecute" nocase
        $cf2 = "cfscript" nocase
        $cf3 = "evaluate(" nocase
        $cf4 = "createObject(" nocase
        $inject1 = "${" ascii
        $inject2 = "#evaluate" nocase

    condition:
        uint16(0) == 0x3C3F or 2 of ($cf*) or any of ($inject*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105903 ColdFusion Code Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/CFIDE/"; nocase; http.request_body; content:"cfexecute"; nocase; http.request_body; content:"createObject"; nocase; classtype:attempted-admin; sid:2026105903; rev:1;)

Elastic Detection

process where event.type == "start" and
process.parent.name in ("jrun.exe", "coldfusion.exe", "httpd.exe") and
process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "bash", "sh")

Splunk SPL Query

index=web OR index=cf_logs (sourcetype=access_combined OR sourcetype=coldfusion)
| search (uri_path="/CFIDE/*" OR uri_path="*.cfm" OR uri_path="*.cfc")
| search (request_body="*cfexecute*" OR request_body="*createObject*" OR request_body="*evaluate(*" OR request_body="*${*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, http_method
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="coldfusion,web,attack,">
  <rule id="105903" level="12">
    <if_sid>31100</if_sid>
    <match>CFIDE</match>
    <regex>cfexecute|createObject|evaluate\(|\$\{</regex>
    <description>CVE-2026-105903: Possible ColdFusion code injection exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to ColdFusion administrative interfaces (e.g., /CFIDE/administrator) to trusted management networks only.
   • Apply least-privilege principles to accounts that can interact with ColdFusion application components; audit and reduce low-privileged accounts.
   • Deploy WAF rules blocking known code-injection patterns targeting ColdFusion endpoints, using the detection signatures above as a baseline.
   • Enable detailed request and process logging on ColdFusion hosts, and monitor for anomalous child processes spawned by the ColdFusion service.

2. Patch / upgrade steps:

   • No patch is currently available per tracked sources. Monitor Adobe's official ColdFusion security advisories and the NVD entry for CVE-2026-105903 for a vendor fix.
   • When a patch is released, prioritize immediate upgrade given the critical severity (9.9) and low exploitation complexity.

3. Long-term hardening:

   • Isolate ColdFusion servers in segmented network zones with strict egress filtering.
   • Run ColdFusion services under dedicated, minimally privileged OS accounts.
   • Conduct regular code review of ColdFusion templates and components for dynamic evaluation anti-patterns.
   • Integrate vulnerability management to flag unpatched ColdFusion instances and enforce configuration baselines.

References

• NVD — CVE-2026-105903: https://nvd.nist.gov/vuln/detail/CVE-2026-105903
• MITRE CWE-94 — Improper Control of Generation of Code: https://cwe.mitre.org/data/definitions/94.html
• FIRST EPSS (no score currently assigned): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Adobe ColdFusion Security Advisories: https://helpx.adobe.com/security/products/coldfusion.html