CVE-2026-106616
8.6HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-611
Impact
Unauthenticated remote attackers can read arbitrary files from the server's filesystem over the network. They only need network access to the ColdFusion instance with no prior privileges or user interaction required.
Root cause
The XML parser improperly restricts XML external entity (XXE) references during input processing.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade to the patched ColdFusion release specified in Adobe advisory APSB26-144, or restrict network access to ColdFusion endpoints parsing external XML until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.