Act nowDisclosed

Advisory · CVE-2026-106622

SSRF in ColdFusion can escalate privileges

ColdFusion has a server-side request forgery vulnerability Adobe says can result in privilege escalation, reachable without authentication or user interaction. Adobe rates it CVSS 3.1 10.0.

Advisory published October 13, 2026Independent summary
Vendor
Adobe
Product
ColdFusion
Identifier / CWE
CVE-2026-106622
CWE-918
Action timing
Immediate
ELI5

Explain it like I’m five

The server can be tricked into making requests on the attacker's behalf to places only it can reach, and those places trust it.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Attacker supplies a target

    An unauthenticated attacker gives ColdFusion a URL or internal address to fetch.

  2. 02Server fetches it

    ColdFusion makes the request from inside its own network position.

  3. 03Trust is abused

    The response or action is used to escalate the attacker's privileges.

What happened

Adobe disclosed CVE-2026-106622 in bulletin APSB26-144: a server-side request forgery vulnerability (CWE-918) in ColdFusion that could result in privilege escalation, scored 10.0 with changed scope.

Adobe lists the affected ColdFusion releases in APSB26-144 (the NVD record names the 2023 update line through 2023.0.25, with 2023.0.26 listed as unaffected). Apply the update Adobe provides for your release line.

What to do

  1. Inventory every ColdFusion deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to ColdFusion while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for outbound requests from ColdFusion servers to internal or link-local addresses and unexpected calls to internal admin endpoints.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

SSRF at 10.0 is a bridge from the internet into your internal network. Update, and review what ColdFusion servers can reach.