CVE-2026-106613
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-20
Impact
Authenticated attackers with low privileges can execute arbitrary code on the host in the context of the ColdFusion service user. They only need network access and valid low-privileged credentials without any user interaction.
Root cause
ColdFusion fails to properly validate input, permitting arbitrary code execution.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the updates specified in Adobe advisory APSB26-144; if patching immediately is not possible, restrict network access to ColdFusion administrative and authenticated endpoints to trusted IP addresses.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.