Loading vulnerability…
Application Denial of Service in Adobe ColdFusion
CVE-2026-105900 is an improper input validation vulnerability in Adobe ColdFusion 2023 releases before Update 26 and ColdFusion 2025 releases before Update 14, affecting all supported platforms. An unauthenticated attacker can exploit the vulnerability over a network to crash the application without user interaction. The vulnerability is rated High with a CVSS v3 base score of 7.5. The affected function and precise triggering input have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes an application crash and denial of service, disrupting the availability of affected ColdFusion applications. No confidentiality or integrity impact is identified for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is documented. General ColdFusion hardening guidance is not established as preventing exploitation of this issue.
Patch, then assume compromise.
Upgrade Adobe ColdFusion 2023 to Update 26 (2023.0.26) or ColdFusion 2025 to Update 14 (2025.0.14), or a later supported release incorporating the fix, following Adobe security bulletin APSB26-144 and the applicable installation instructions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.