Act nowDisclosed

Advisory · CVE-2026-106624

Second unauthenticated code injection in ColdFusion, also 10.0

ColdFusion has a further code generation flaw in APSB26-144 that an unauthenticated attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 10.0.

Advisory published October 13, 2026Independent summary
Vendor
Adobe
Product
ColdFusion
Identifier / CWE
CVE-2026-106624
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

Another path, same destination: anonymous input becomes server-side code in ColdFusion.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Reach ColdFusion

    An attacker sends requests to a ColdFusion server.

  2. 02Flaw engaged

    The vulnerable function processes the attacker's input without the control it needed.

  3. 03Code executes

    Arbitrary code runs in the context of the ColdFusion service user.

What happened

Adobe disclosed CVE-2026-106624 in bulletin APSB26-144 as a distinct improper control of generation of code vulnerability (CWE-94) in ColdFusion, alongside CVE-2026-106621 in the same bulletin.

Adobe lists the affected ColdFusion releases in APSB26-144 (the NVD record names the 2023 update line through 2023.0.25, with 2023.0.26 listed as unaffected). Apply the update Adobe provides for your release line.

What to do

  1. Inventory every ColdFusion deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to ColdFusion while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for unexpected ColdFusion child processes and application or configuration files changed outside release windows.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Two 10.0-class code execution paths in one bulletin means exposure assessment should assume the server was reachable and interesting to attackers. Update and investigate.