Adobe ColdFusion 2023 and 2025 contain a Server-Side Request Forgery (SSRF) vulnerability, CVSS 10.0, that a remote attacker can exploit without authentication or user interaction and that can lead to privilege escalation.
What Is It
CVE-2026-106622 is a Server-Side Request Forgery flaw (CWE-918) in Adobe ColdFusion. Adobe PSIRT reported it, and NVD published it on October 13, 2026. According to the vendor description, exploitation "could result in privilege escalation" and "does not require user interaction." The vulnerability has a changed scope, which means a successful exploit can affect resources beyond the vulnerable component itself.
NVD lists the record's status as "Received," so NVD has not yet finished analyzing it.
Why It Matters
Adobe gave the issue the maximum CVSS v3.1 base score of 10.0 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H:
- Network attack vector, low complexity: the flaw can be exploited remotely without special conditions.
- No privileges or user interaction required: an unauthenticated attacker can trigger it directly.
- Changed scope: the impact reaches past the vulnerable component.
- High impact to confidentiality, integrity, and availability.
The CVE has an exploitability subscore of 3.9 and an impact subscore of 6.0.
As of this writing, the CISA Known Exploited Vulnerabilities (KEV) catalog does not list this CVE. KEV therefore does not confirm active exploitation, and CISA has not issued a required action for it. Even so, an unauthenticated, network-reachable bug with a perfect severity score should be treated as a priority for any internet-facing ColdFusion deployment.
What's Vulnerable
The Adobe-supplied data in the NVD record lists these affected versions:
| Product | Affected | First Unaffected |
|---|---|---|
| ColdFusion 2025 | 2025.0.13 and earlier | 2025.0.14 |
| ColdFusion 2023 | 2023.0.25 and earlier | 2023.0.26 |
The NVD record does not include any CPE matches yet.
Patch Status
Adobe has released fixed versions:
- ColdFusion 2025: update to 2025.0.14 or later.
- ColdFusion 2023: update to 2023.0.26 or later.
Adobe's security bulletin APSB26-144 has the vendor's guidance. Administrators should check which ColdFusion versions they run and apply the updates promptly, starting with systems exposed to the internet.