Adobe Patches Critical Apache Tika Bug in ColdFusion

Adobe has released patches for 25 vulnerabilities across 11 products, including a critical Apache Tika flaw in ColdFusion. The issue, tracked as CVE-2025-66516 with a CVSS score of 10/10, is an XML External Entity injection that could be exploited via XFA files placed inside PDF documents. The defect was previously addressed in December, when Apache warned that exploitation could lead to information leaks, SSRF, denial-of-service, or remote code execution.

On 13 January 2026, Adobe issued a ColdFusion security update to resolve CVE-2025-66516, noting that ColdFusion 2025 Update 5 and earlier, and ColdFusion 2023 Update 17 and earlier, are affected on all platforms, with the fix appearing in ColdFusion 2025 Update 6 and ColdFusion 2023 Update 18; a priority rating of ‘1’ was applied. The report, according to SecurityWeek, also notes updates for Dreamweaver and several other Adobe products on January 2026 Patch Tuesday.