CVE-2026-106624: 
Adobe ColdFusion vulnerability analysis and mitigation

CVE-2026-106624 is a critical Code Injection vulnerability (CWE-94) in Adobe ColdFusion that allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without any user interaction. It affects ColdFusion 2023 (up to and including update 25 / version 2023.0.25) and ColdFusion 2025 (up to and including update 13 / version 2025.0.13). The vulnerability was published on October 13, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 10.0 (Critical) with a changed scope, reflecting the potential for impact beyond the vulnerable component itself (GitHub Advisory, Adobe Advisory).

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code / 'Code Injection'), meaning ColdFusion fails to properly neutralize externally-supplied input before using it to construct or evaluate code segments. The attack vector is network-accessible, requires no authentication, no privileges, and no user interaction, making it fully automatable. The changed scope indicator suggests that successful exploitation can affect resources or components beyond the ColdFusion application itself, such as the underlying operating system or adjacent services. No specific technical write-up or public proof-of-concept code has been identified at this time (GitHub Advisory, Adobe Advisory).

Successful exploitation grants an unauthenticated remote attacker the ability to execute arbitrary code in the context of the ColdFusion application user, with high impact to confidentiality, integrity, and availability. The changed scope means the attacker may be able to pivot beyond the ColdFusion process to affect the host operating system or other co-located services, enabling data exfiltration, service disruption, or lateral movement within the network. Given that no authentication or user interaction is required, the entire attack chain can be automated and executed at scale against internet-facing ColdFusion instances (GitHub Advisory, Adobe Advisory).

As of the time of publication, there is no evidence of a public proof-of-concept exploit or confirmed in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment classifies the vulnerability as automatable with total technical impact, indicating a high likelihood of exploitation if a PoC becomes available. The EPSS score is approximately 1.098% (65th percentile), reflecting a moderate near-term exploitation probability. No threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time (GitHub Advisory).

Adobe has released patched versions addressing this vulnerability: ColdFusion 2023 update 26 (version 2023.0.26) and ColdFusion 2025 update 14 (version 2025.0.14). Organizations should prioritize immediate patching given the critical CVSS 10.0 score and the unauthenticated, network-accessible nature of the flaw. As an interim measure, consider restricting network access to ColdFusion administrative interfaces and application endpoints, and monitor for anomalous code execution or outbound connections from ColdFusion servers until patching is complete (Adobe Advisory, GitHub Advisory).

The vulnerability was noted in October 2026 Patch Tuesday roundup coverage, with security outlets highlighting it as part of a broader cluster of critical Adobe ColdFusion vulnerabilities patched that month (CSO Online, ThreatAft). Ivanti's Patch Tuesday blog and AUSCERT also flagged the advisory for immediate attention. Community sentiment reflects urgency given the maximum CVSS score and the historical pattern of ColdFusion vulnerabilities being rapidly weaponized (Ivanti Blog, AUSCERT).