Arbitrary filesystem read via Adobe ColdFusion RDS affects enterprise web apps; widespread Adobe product feature with high-impact data exposure.
CVE-2026-90530
Path traversal in ColdFusion RDS enabling remote arbitrary file reads.
Is CVE-2026-90530 being exploited?
Not confirmed. CVE-2026-90530 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.27% probability of exploitation in the next 30 days.
How severe is CVE-2026-90530?
CVE-2026-90530 is rated Critical with a CVSS score of 9.3. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-90530?
Not known from our data. No patch reference has been recorded for CVE-2026-90530, which is not the same as no patch existing — a fix may have shipped without a tagged reference, or after this record was written. The vendor advisory is the only authority on whether a fix exists, and mitigations may be available regardless.
What does CVE-2026-90530 affect?
CVE-2026-90530 affects Adobe ColdFusion (RDS enabled), ColdFusion servers not in Production Secure Profile. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-90530?
Disable RDS, enable Production Secure Profile, restrict access, and apply vendor updates when released.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Remote, unauthenticated path traversal via RDS allowing arbitrary file reads and disclosure of sensitive files/credentials.
Immediate action required