IT SBIT Services
Schneeberger
DEEN
CVE tracker

Adobe ColdFusion: Code injection allowing arbitrary code execution

CVE-2026-106621Critical 9.1

← All vulnerabilities

Summary

Adobe ColdFusion 2025 up to 2025.0.13 and ColdFusion 2023 up to 2023.0.25 contain a code injection flaw (CWE-94) in which code generation is not properly controlled. According to the CVE description, an unauthenticated remote attacker without user interaction can execute arbitrary code in the context of the current user. Adobe's bulletin lists the impact as privilege escalation instead, so the sources are inconsistent on the exact impact. Adobe reports no known exploitation in the wild.

Affected

  • Adobe ColdFusion 2025: 0 to 2025.0.13 (all platforms)
  • Adobe ColdFusion 2023: 0 to 2023.0.25 (all platforms)

Fixed in

  • Adobe ColdFusion 2025: update to 2025.0.14 (Update 14)
  • Adobe ColdFusion 2023: update to 2023.0.26 (Update 26)
  • Update 26 for 2023 includes a Tomcat upgrade and changes that may need admin action, such as stricter report template paths and admin endpoint rules. Review the release notes before updating.

Workaround

  • No vendor workaround specific to this CVE. Adobe recommends applying the security configuration settings and reviewing the lockdown guides in its ColdFusion documentation.
  • Check Point has published an IPS protection that detects exploitation attempts. It is a compensating control, not a fix.

Exploitation

  • Adobe is not aware of any exploits in the wild for the issues in this update.
  • No public proof of concept was found in research.
  • CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
  • CISA KEV status has not been verified directly.

Our recommendation

  • Inventory all ColdFusion instances, including test and legacy servers.
  • Update to 2025.0.14 or 2023.0.26 (or later) as a priority. Plan against the Priority 1 rating in Adobe's solution table, because the bulletin header says Priority 2.
  • Restrict internet exposure of ColdFusion admin and application ports until patched.
  • Enable IPS protection on perimeter gateways as an interim measure.
  • Check for signs of compromise: unexpected files in web roots, new scheduled tasks, unusual child processes of the ColdFusion service.
  • Patch the whole October 2026 bulletin, because other critical flaws such as CVE-2026-105899 are fixed in the same release.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:40.

Original description (NVD)

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed