CVE-2026-106621 Enables Arbitrary Code Execution in Adobe ColdFusion Without User Interaction
A critical code injection flaw in Adobe ColdFusion allows remote attackers to run arbitrary code without needing victim interaction.
Key points
- The vulnerability is rated CVSS 9.1 Critical and involves improper control of code generation under CWE-94.
- Exploitation does not require any user interaction, making automated scanning and immediate execution feasible.
- Adobe ColdFusion 2023 versions up to 2023.0.25 and 2025 versions up to 2025.0.13 are affected by this issue.
Remote attackers can execute arbitrary code on servers running vulnerable versions of Adobe ColdFusion. This capability allows an intruder to seize control of the application context without needing a user to click a link or open a file. The National Vulnerability Database rates the flaw as Critical with a CVSS score of 9.1.
How it unfolded
- The vulnerability was cataloged as CVE-2026-106621 in the National Vulnerability Database records.
- Adobe ColdFusion 2023 and 2025 versions were identified as affected products in the advisory.
- The flaw was classified under CWE-94 for improper control of code generation techniques.
Who is affected
Organizations using Adobe ColdFusion 2023 up to version 2023.0.25 are exposed to this risk. Additionally, deployments of Adobe ColdFusion 2025 up to version 2025.0.13 face the same threat. Any instance within these version ranges lacks the necessary controls to prevent this specific code injection attack vector.
The fix
No patch or remediation update has been confirmed in the source material. Administrators should monitor official Adobe channels for a security release. Until a fix is available, systems running the affected versions remain vulnerable to exploitation.
What made it possible
Code injection flaws occur when an application incorporates untrusted data into executable logic without proper validation. Attackers exploit this by supplying crafted input that the server interprets as commands rather than content. This technique bypasses standard access controls because the server executes the injected code with its own privileges. Teams usually monitor for anomalous process creation or unexpected outbound connections. Check whether input handling routines sanitize data before processing.
What to do and how to stay safe: Adobe ColdFusion
- Review server logs for signs of unauthorized code execution or unusual system calls.
- Restrict network access to ColdFusion instances to limit exposure to untrusted sources.
- Verify current version numbers against the affected ranges listed in the advisory.
- Prepare incident response plans for potential remote code execution scenarios.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of ColdFusion are affected?
Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13 are affected.
Does an attacker need to trick a user to exploit this?
No, exploitation does not require user interaction according to the vulnerability description.
What is the severity rating of this flaw?
The National Vulnerability Database rates CVE-2026-106621 as Critical with a CVSS score of 9.1.
