CVE-2026-106624

Adobe ColdFusion is affected by a critical code-injection flaw (CWE-94) that can lead to arbitrary code execution in the context of the current user. The issue is remotely exploitable over the network with low complexity, requires no privileges and no user interaction, and CVSS marks scope as changed with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 10.0). An attacker who reaches a vulnerable server could run arbitrary code without interaction. The supplied data does not name affected version ranges, so any ColdFusion deployment should be treated as in scope until Adobe's advisory confirms otherwise. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply Adobe's security update for ColdFusion as soon as a fixed build is published for your release, and until then keep the server off the public internet (or behind a VPN/allowlist). Restrict access to ColdFusion administration and application endpoints, and review logs for unexpected code execution or new files under the application user.