cyfenced.com →

[ CVE-2026-106622 · Published 13 Oct 2026 ]

Vulnerability in Adobe ColdFusion 2025

CVSS 10.0 EPSS <1%3 agency advisoriesNo fix listed yet

[ Why it matters ]Priority signals

  • Critical severity: CVSS 10.0

[ Description ]Official description

ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • NCSC-NLNCSC-2026-0435

    Vulnerabilities fixed in Adobe ColdFusion Translated from Dutch

    Probability/damage M/HCVE-2026-105897CVE-2026-105898CVE-2026-105899+29 more CVEs
  • CERT-FRCERTFR-2026-AVI-1301

    Multiple vulnerabilities in Adobe products Translated from French

    Multiple vulnerabilities have been discovered in Adobe products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-71385CVE-2026-92911CVE-2026-95631+41 more CVEs
  • BSI CERT-BundWID-SEC-2026-3945

    Adobe ColdFusion: Multiple vulnerabilities Translated from German

    CVE-2026-106618CVE-2026-106623CVE-2026-71385+29 more CVEs

[ References ]References