CVE-2026-106621

9.1Critical

Published 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

9.1Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-94

Impact

Unauthenticated remote attackers can execute arbitrary code in the context of the ColdFusion service account over the network. No credentials or user interaction are required.

Root cause

Improper control of code generation allows attackers to inject and execute arbitrary code.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Fix & remediation

Apply the patch referenced in Adobe advisory APSB26-144 immediately. If patching cannot happen right away, restrict network access to ColdFusion endpoints at the firewall or reverse proxy.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

References

https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.htmlVendor Advisory

Source: nvd.nist.gov/vuln/detail/CVE-2026-106621