CVE-2026-106622

Adobe ColdFusion is affected by a server-side request forgery (SSRF) flaw, tracked as CVE-2026-106622 (CWE-918), that Adobe says can lead to privilege escalation. The issue is remotely exploitable with low complexity, requires no privileges and no user interaction, and is scored CVSS 3.1 10.0 with changed scope and high impact on confidentiality, integrity, and availability. An attacker who can reach a vulnerable ColdFusion instance could cause the server to make requests that were not intended and, through that, escalate privileges. Who is affected depends on the ColdFusion builds Adobe lists in its bulletin; specific version ranges were not included in the data provided here. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply Adobe's security update for this CVE as soon as it is available for your ColdFusion release, and treat internet-facing instances as urgent. Until patched, restrict ColdFusion (especially the administrator and any URL-fetch features) to trusted networks, block outbound requests to internal and cloud metadata addresses, and review logs for unexpected server-side requests. Confirm the fix against Adobe's bulletin rather than assuming a version not listed there.