Adobe has disclosed CVE-2026-106624, a critical code injection vulnerability in ColdFusion 2025 and 2023 that could allow unauthenticated remote attackers to execute arbitrary code without user interaction.
What Is It
CVE-2026-106624 is an Improper Control of Generation of Code ('Code Injection') vulnerability (CWE-94) in Adobe ColdFusion. According to the NVD record, successful exploitation could result in arbitrary code execution in the context of the current user. Exploitation does not require user interaction, and the scope is changed.
Adobe PSIRT submitted the record, and NVD published it on October 13, 2026. Its NVD status is currently "Received," which means NVD has not yet analyzed it.
Why It Matters
Adobe has scored the flaw at the CVSS v3.1 maximum of 10.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This means:
- Attack Vector: Network. It can be exploited remotely.
- Attack Complexity: Low. No special conditions are required.
- Privileges Required: None. No authentication is needed.
- User Interaction: None. No victim action is needed.
- Scope: Changed. The impact can extend beyond the vulnerable component.
- Confidentiality, Integrity, Availability: High. An attacker could fully compromise the affected system.
As of this writing, CVE-2026-106624 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation. Even so, a remotely reachable, unauthenticated code execution flaw with this profile should be treated as a high-priority patch.
What's Vulnerable
Per Adobe's affected-version data in the NVD record:
| Product | Affected Versions | First Unaffected Version |
|---|---|---|
| Adobe ColdFusion 2025 | Up to and including 2025.0.13 | 2025.0.14 |
| Adobe ColdFusion 2023 | Up to and including 2023.0.25 | 2023.0.26 |
NVD does not list any CPE entries for this CVE yet.
Patch Status
Adobe lists ColdFusion 2025 version 2025.0.14 and ColdFusion 2023 version 2023.0.26 as unaffected. Organizations running ColdFusion should:
- Find all ColdFusion 2025 and 2023 instances, especially internet-facing ones.
- Update to 2025.0.14 or 2023.0.26 or later, as appropriate.
- Check Adobe security bulletin APSB26-144 for full update guidance.
There is no CISA KEV entry, so no federal required action or remediation due date applies at this time.