CVE-2026-106622
10.0CriticalPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-918
Impact
Remote attackers can abuse the server to make unauthorized requests, leading to full privilege escalation across the environment. They only need network access to ColdFusion, with no credentials or user interaction required.
Root cause
Adobe ColdFusion fails to properly validate destination URLs, enabling server-side request forgery (SSRF).
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade ColdFusion to the patched release referenced in Adobe advisory APSB26-144 immediately. If patching cannot happen right away, restrict ColdFusion outbound network access and block untrusted external access to the ColdFusion administrator interface.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.