Adobe has disclosed CVE-2026-106621, a CVSS 9.1 code injection vulnerability in ColdFusion 2025 and 2023 that could let a remote attacker execute arbitrary code without authentication or user interaction.
What Is It
CVE-2026-106621 is an Improper Control of Generation of Code ("Code Injection") vulnerability (CWE-94) in Adobe ColdFusion. Adobe reports that successful exploitation could result in arbitrary code execution in the context of the current user, and that exploitation does not require user interaction.
Adobe PSIRT reported the issue, and NVD published it on October 13, 2026. The NVD record is in "Received" status, which means NVD has not yet completed its own analysis.
Why It Matters
Adobe scored the flaw 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which breaks down as follows:
- Network-reachable: an attacker can exploit it remotely.
- Low attack complexity: no special conditions are needed.
- No privileges required: the attacker does not need to be authenticated.
- No user interaction: no one has to click or open anything.
- High impact to confidentiality and integrity. The score lists no availability impact.
ColdFusion servers often run web-facing applications, so an unauthenticated remote code execution path like this one should get urgent attention.
Exploitation status: The supplied CISA KEV data does not include this CVE. Active exploitation has not been confirmed by KEV at the time of writing.
What's Vulnerable
According to the Adobe-supplied affected-product data:
| Product | Affected Versions | First Unaffected Version |
|---|---|---|
| Adobe ColdFusion 2025 | 2025.0.13 and earlier | 2025.0.14 |
| Adobe ColdFusion 2023 | 2023.0.25 and earlier | 2023.0.26 |
The record does not list any CPE entries yet.
Patch Status
Adobe lists fixed versions for both affected release lines:
- ColdFusion 2025: upgrade to 2025.0.14 or later
- ColdFusion 2023: upgrade to 2023.0.26 or later
Remediation details are in Adobe security bulletin APSB26-144. There is no CISA KEV required action or due date for this CVE, because it is not in the supplied KEV data. Given the critical severity and unauthenticated network attack vector, organizations running affected ColdFusion versions should prioritize applying these updates.