Adobe ColdFusion: Server-Side Request Forgery leading to privilege escalation

Summary

Adobe ColdFusion 2023 and 2025 contain a Server-Side Request Forgery (SSRF) vulnerability tracked as CVE-2026-106622. According to the CVE record and CVSS vector, a remote attacker without credentials and without user interaction can abuse it to escalate privileges, with high impact on confidentiality, integrity and availability. Adobe is not aware of any exploitation in the wild. One third-party source describes the flaw as code injection, so the exact root cause is not fully confirmed.

Affected

• Adobe ColdFusion 2025: 0 to 2025.0.13
• Adobe ColdFusion 2023: 0 to 2023.0.25
• Platform: all

Fixed in

• Adobe ColdFusion 2025 Update 14 (2025.0.14)
• Adobe ColdFusion 2023 Update 26 (2023.0.26)

Advisory: APSB26-144, published 13 October 2026, last updated 21 October 2026.

Workaround

• Update 26 adds an outbound network security policy for server-initiated HTTP/HTTPS connections, configured in cfusion/lib/security-settings.json. Keep the SSRF protection setting enabled.
• Known issue: the outbound policy checks only the top-level URL fetched by cfdocument, not sub-resource URLs inside rendered HTML. Do not render untrusted HTML that contains external resource URLs until Adobe fixes this.
• Until the update is installed, restrict outbound connections from the ColdFusion server at the firewall and limit access to the administrator interface and untrusted-document features.

Exploitation

• Adobe is not aware of any exploits in the wild for the issues in this update.
• The CVE is not listed in the CISA KEV catalogue. CISA SSVC: exploitation none, automatable yes, technical impact total.
• EPSS was about 0.7% in late October 2026.
• No public proof-of-concept was found.

Our recommendation

• Treat this as urgent. Internet-facing ColdFusion servers should be patched within the same week; internal-only servers in the normal emergency cycle.
• Check the installed ColdFusion version and update to 2025.0.14 or 2023.0.26 (APSB26-144 covers 32 CVEs in total).
• Apply the outbound network restrictions and the Update 26 security policy, and keep the SSRF protection enabled.
• Monitor outbound connections from the ColdFusion server and review logs for unexpected server-side requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Adobe Security Bulletin APSB26-144 www.adobe.com
• ColdFusion 2023 Release Update 26 documentation guides.adobe.com
• Adobe October 2026 security fixes (blacktree.nl) blacktree.nl
• Tenable plugin 366551 (differing root-cause description) www.tenable.com
• VulDB entry 418496 (different CVSS score) vuldb.com
• GitHub Advisory GHSA-g6h4-j5vh-j666 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:16.