Key points
- Adobe ColdFusion 2023 up to 2023.0.25 is affected by CVE-2026-106622.
- Adobe ColdFusion 2025 up to 2025.0.13 is affected by CVE-2026-106622.
- The flaw has a CVSS score of 10.0 and is rated Critical.
Adobe ColdFusion 2023 versions prior to 2023.0.25 and Adobe ColdFusion 2025 versions prior to 2025.0.13 are impacted by a severe security issue identified as CVE-2026-106622. The vulnerability carries a CVSS score of 10.0, which is classified as Critical severity. This rating reflects the significant risk posed by the flaw to systems running these specific software versions.
In plain English
The issue involves a Server-Side Request Forgery weakness, categorized under CWE-918. This type of flaw allows attackers to manipulate the server into making unintended requests. Exploitation does not require any interaction from users, meaning the attack can proceed without human input. The potential outcome of a successful exploit includes privilege escalation, granting attackers higher access levels than they initially held.
The background
The National Vulnerability Database records this flaw as having a changed scope, which influences the severity calculation. The specific weakness is tied to how the application handles server-side requests. No user interaction is needed for an attacker to trigger the vulnerability, making it easier to exploit compared to flaws that require clicking a link or submitting a form. The impact is described as potentially resulting in privilege escalation.
What changes now
Organizations using the affected versions must verify their current installations against the affected ranges. If a system falls within the versions up to 2023.0.25 or up to 2025.0.13, it is considered vulnerable. Security teams should prioritize identifying these instances in their environment. The high severity score indicates that the risk is substantial, warranting immediate attention to inventory and assess exposure across the organization's infrastructure.
Who needs to act first
Teams usually prioritize systems exposed to untrusted networks or the public internet first, as these face the highest risk. Before applying changes, administrators should verify backups of affected servers to ensure recovery options exist. Testing updates in a non-production environment helps confirm that business functions remain stable after remediation. Organizations should also review network access controls to limit exposure while preparing for updates, reducing the window of opportunity for potential attackers.
What to do and how to stay safe: Adobe ColdFusion
- Inventory all instances of Adobe ColdFusion to identify versions 2023.0.25 and earlier, and 2025.0.13 and earlier.
- Restrict network access to vulnerable ColdFusion servers to limit exposure from untrusted sources.
- Monitor logs for unusual server-side request activity that could indicate exploitation attempts.
- Prepare to apply vendor updates as soon as they are released to resolve the SSRF weakness.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific ColdFusion versions are vulnerable?
Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13 are affected.
Does exploiting this flaw require user interaction?
No, exploitation of this issue does not require user interaction.
What is the severity rating of CVE-2026-106622?
The vulnerability has a CVSS score of 10.0 and is rated Critical.
