Advisory · CVE-2026-106621
Unauthenticated code injection in ColdFusion
ColdFusion improperly controls code generation in a path an unauthenticated attacker can use to execute arbitrary code. Adobe rates it CVSS 3.1 9.1.
- Vendor
- Adobe
- Product
- ColdFusion
- Identifier / CWE
- CVE-2026-106621
CWE-94 - Action timing
- Immediate
Explain it like I’m five
No account, no problem for the attacker: ColdFusion can be made to generate and run code from a stranger's input.
- 01Reach ColdFusion
An attacker sends requests to a ColdFusion server.
- 02Flaw engaged
The vulnerable function processes the attacker's input without the control it needed.
- 03Code executes
Arbitrary code runs in the context of the ColdFusion service user.
What happened
Adobe disclosed CVE-2026-106621 in bulletin APSB26-144: an improper control of generation of code vulnerability (CWE-94) in ColdFusion that could result in arbitrary code execution without authentication.
Adobe lists the affected ColdFusion releases in APSB26-144 (the NVD record names the 2023 update line through 2023.0.25, with 2023.0.26 listed as unaffected). Apply the update Adobe provides for your release line.
What to do
- Inventory every ColdFusion deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to ColdFusion while remediation is underway, especially for internet-facing instances.
- Review application and server logs for code-shaped payloads in request logs, ColdFusion spawning unexpected processes, and files changed outside deployments.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Unauthenticated code injection needs no further argument. Update ColdFusion and hunt for dropped files.