Adobe has disclosed a critical improper input validation vulnerability (CVSS 9.0) in ColdFusion 2025 and 2023 that could let an unauthenticated attacker run arbitrary code.
What Is It
CVE-2026-106619 is an Improper Input Validation weakness (CWE-20) in Adobe ColdFusion. Adobe says it "could result in arbitrary code execution in the context of the current user." Adobe PSIRT reported the issue, and NVD published it on October 13, 2026. The record's status is currently "Received."
According to the advisory description, exploitation:
- does not require user interaction
- "depends on conditions beyond the attacker's control"
- results in a changed scope, so impact can reach beyond the vulnerable component
Why It Matters
Adobe rates the flaw 9.0 CRITICAL under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H:
- Network attack vector: can be exploited remotely
- No privileges required: the attacker does not need to be logged in
- High attack complexity: success depends on conditions the attacker cannot control, which accounts for the 2.2 exploitability subscore
- High impact to confidentiality, integrity and availability, with a changed scope
ColdFusion servers are often exposed to the internet, so an unauthenticated remote code execution flaw deserves prompt attention even with high attack complexity.
Exploitation status: As of October 13, 2026, CVE-2026-106619 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, so active exploitation has not been confirmed.
What's Vulnerable
| Product | Affected Versions | First Unaffected Version |
|---|---|---|
| Adobe ColdFusion 2025 | 2025.0.13 and earlier | 2025.0.14 |
| Adobe ColdFusion 2023 | 2023.0.25 and earlier | 2023.0.26 |
No CPE entries are listed in the NVD record yet.
Patch Status
Adobe has published security bulletin APSB26-144 for this issue. Adobe lists these versions as unaffected:
- ColdFusion 2025: Update 14 (2025.0.14)
- ColdFusion 2023: Update 26 (2023.0.26)
Administrators should move to these versions or later and follow the guidance in APSB26-144. Because the CVE is not in the CISA KEV catalog, no federal required action or due date under Binding Operational Directive 22-01 applies at this time.