ColdFusion in the October Adobe pile: why pre-auth server bugs still jump the queue

Adobe's October 2026 security bulletin APSB26-144 addresses multiple vulnerabilities in Adobe ColdFusion, including pre-authentication remote code execution. The ZDI's October 2026 Patch Tuesday review covers the ColdFusion entries alongside the broader Adobe and Microsoft release.

In a month where Microsoft shipped approximately 1,400 CVEs and Adobe's broader bulletin stack included Acrobat, Photoshop, Substance 3D, and more, ColdFusion vulnerabilities are easily buried. They should not be. ColdFusion's deployment profile creates a specific risk pattern that makes pre-authentication server bugs disproportionately dangerous.

APSB26-144 summary

Verify all CVE IDs and CVSS scores from APSB26-144 — scores may be updated after initial publication.

*Verify exact CVE IDs and CVSS values in the APSB26-144 bulletin before treating the above as authoritative.*

Why ColdFusion pre-auth RCE is disproportionately dangerous

ColdFusion is not a commodity web framework. Its deployment profile has specific characteristics that amplify the risk of server-side bugs:

ColdFusion pre-authentication RCE is not the same risk as ColdFusion post-authentication RCE. Pre-auth means the attack surface is every IP address on the internet. The credential requirement is removed entirely.

ColdFusion in the October advisory landscape

The October 2026 Patch Tuesday week produced four distinct high-priority security events:

ColdFusion arriving simultaneously with a record Microsoft Patch Tuesday creates advisory noise that deprioritises the Adobe bulletin. That noise is a risk: ColdFusion pre-auth RCE is one of the finding classes that historically appears in KEV shortly after disclosure.

Identifying ColdFusion on engagement scope

ColdFusion typically exposes itself through:

# HTTP headers: ColdFusion often sets server header or JSESSIONID cookie
curl -I https://target.example.com/ | grep -i "coldfusion\|jrun\|adobe"

# Default ColdFusion admin path
curl -s -o /dev/null -w "%{http_code}" https://target.example.com/CFIDE/administrator/

# ColdFusion file extensions in web paths
# .cfm (ColdFusion markup), .cfc (ColdFusion component), .cfml

# Wappalyzer / whatweb technology detection
whatweb https://target.example.com | grep -i coldfusion

Confirming the version:

# If CFIDE/administrator is accessible:
# Version displayed on login page
# Or check /CFIDE/administrator/index.cfm

# If foothold on the server (Windows):
reg query "HKLM\\SOFTWARE\\Adobe\\ColdFusion" /s | findstr "Version"
# Or check the installer/lib directory version files

Operator sequencing

For engagements where ColdFusion is in scope or discovered during reconnaissance:

1. Confirm version and update level. The patched versions are ColdFusion 2025 Update 2 and ColdFusion 2023 Update 12. Anything earlier is vulnerable to the pre-auth RCE paths.

1. Check CFIDE/administrator exposure. The administrator console is a high-value target even without the new CVEs. If it is internet-accessible without network restriction, document that separately.

1. Test pre-auth exploitability. The deserialization and file upload paths in pre-auth RCE are testable from an unauthenticated position. Confirm scope authorisation before testing; capture full HTTP request/response evidence.

1. Check for KEV status. As of the Oct 8 advisory, APSB26-144 CVEs were not in the KEV catalog. Monitor for additions — ColdFusion pre-auth RCE has historically been weaponised quickly.

1. Assess the patching constraint. If ColdFusion hosts a legacy application with a dependency on a specific ColdFusion version, "update to ColdFusion 2025 Update 2" may not be operationally simple. Document the patching constraint as part of the finding so the client has an accurate remediation complexity assessment.

Reporting priority

ColdFusion pre-auth RCE reports as Critical, regardless of what else was found on the engagement. A directly exploitable internet-facing server is the finding that drives executive conversations. Treat APSB26-144 ColdFusion findings as report section 1, not an appendix item.