Adobe ColdFusion: Arbitrary code execution via improper input validation
Summary
Adobe ColdFusion contains an improper input validation flaw (CWE-20, CVE-2026-106619) that can lead to arbitrary code execution in the context of the current user. The attack can be launched over the network without privileges or user interaction, but the attack complexity is high and exploitation depends on conditions outside the attacker's control. Adobe states it is not aware of any exploits in the wild.
Affected
- Adobe ColdFusion 2025: 2025.0.13 and earlier
- Adobe ColdFusion 2023: 2023.0.25 and earlier
- All platforms
Fixed in
- Adobe ColdFusion 2025: update to 2025.0.14 (ColdFusion 2025 Update 14)
- Adobe ColdFusion 2023: update to 2023.0.26 (ColdFusion 2023 Update 26)
Workaround
- No workaround is needed if the fixed version can be installed.
- Apply the security configuration settings from the ColdFusion Security documentation and review the Lockdown guides.
- Restrict administrator and external access to ColdFusion until the patch is applied.
- Adobe advises against rendering untrusted HTML that contains external resource URLs until a known issue is resolved.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues addressed in APSB26-144.
- No public proof of concept was found in the research.
- CISA KEV status was not verified directly.
Our recommendation
- Identify all ColdFusion 2023 and 2025 installations and check whether any are reachable from the internet.
- Patch to 2025.0.14 or 2023.0.26 as a priority (Adobe rates the update priority 1 in the solution table), after testing, because Update 26 includes changes that may require configuration updates.
- Monitor web server and application logs for unusual requests and code execution.
- Review the Adobe bulletin APSB26-144 for the full list of fixed issues in the same update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-144 www.adobe.com
- ColdFusion 2025 Updates (Adobe) guides.adobe.com
- ColdFusion 2023 Updates (Adobe) guides.adobe.com
- ColdFusion 2023 Release Update 26 (Adobe) guides.adobe.com
- Strix CVE-2026-106619 www.strix.ai
- VulDB entry 418488 vuldb.com
- Zero Day Initiative October 2026 security update review www.zerodayinitiative.com
- Blacktree: Adobe October 2026 security fixes blacktree.nl
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:11.
Original description (NVD)
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.