CVE-2026-106621: 
Adobe ColdFusion vulnerability analysis and mitigation

CVE-2026-106621 is a Code Injection vulnerability (CWE-94) in Adobe ColdFusion that allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without any user interaction. It affects ColdFusion 2025 (versions up to and including 2025.0.13 / Update 13) and ColdFusion 2023 (versions up to and including 2023.0.25 / Update 25). The vulnerability was published on October 13, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), meaning ColdFusion constructs or evaluates code segments using externally-influenced input without properly neutralizing special elements that could alter the intended code behavior. The attack vector is network-based, requires no privileges and no user interaction, and has low attack complexity, making it trivially automatable. The NVD SSVC assessment confirms the vulnerability is automatable with total technical impact. No specific vulnerable endpoint or payload details have been publicly disclosed at this time (GitHub Advisory, Adobe Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code in the context of the ColdFusion application process, resulting in high confidentiality and high integrity impact. An attacker could read sensitive data hosted by the ColdFusion server, modify application data or configuration, deploy web shells, or use the compromised server as a pivot point for lateral movement within the network. Availability is not directly impacted per the CVSS scoring, though secondary effects of code execution could disrupt service (GitHub Advisory, Adobe Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.711% (53rd percentile), indicating a moderate but not elevated near-term exploitation probability. The NVD SSVC assessment classifies the vulnerability as automatable, which raises the risk profile if a PoC becomes available. Qualys has added detection support (detection ID 388985) (GitHub Advisory).

Adobe has released patched versions addressing this vulnerability: ColdFusion 2025 Update 14 (2025.0.14) and ColdFusion 2023 Update 26 (2023.0.26). Organizations should apply these updates as soon as possible given the critical severity and unauthenticated remote code execution nature of the flaw. No specific configuration-based workarounds have been published; upgrading to the fixed versions is the recommended remediation (Adobe Advisory, GitHub Advisory).

Coverage of CVE-2026-106621 has been picked up by standard vulnerability tracking platforms including VulDB, CVEFeed, AusCERT (bulletin ESB-2026.12607), FortiGuard IPS updates (version 37.309), and Tenable plugin pipeline. A SOCFortress Medium post covered Adobe's October 2026 security updates broadly. No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified beyond routine aggregation (Adobe Advisory).