Adobe ColdFusion CVE-2026-106616

Exploitation requires network access to a ColdFusion instance (2023 ≤2023.0.25 or 2025 ≤2025.0.13) that accepts and parses attacker-supplied XML with external-entity resolution enabled in the parser. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special privileges are needed, so default-reachable XML-handling functionality is sufficient. Limiting factors: the attacker must be able to reach an XML-processing endpoint, and the host must be running an unpatched vulnerable version; impact is confined to file-system read (confidentiality), with no integrity or availability effect, so exploitation discloses data but does not directly alter or disrupt the system.

This is a credible high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) describes a remote, unauthenticated, low-complexity attack with no user interaction and a changed scope, which is consistent with an XXE (CWE-611) flaw where the XML parser reaches resources beyond the application boundary. Adobe PSIRT is the reporting source, so the vulnerability itself is vendor-confirmed, and ColdFusion has a long history of being targeted in the wild, which raises concern. However, several exploitation-signal fields are MISSING from the input: there is no EPSS probability, no CISA KEV listing, and no POC indicator provided, so exploitation status is 'no public exploit identified at time of analysis.' The absence of these signals should not be read as low risk - it reflects data gaps rather than confirmed safety. The impact is confidentiality-only (C:H, I:N, A:N): successful exploitation yields arbitrary file read, not code execution or service disruption, so the practical worst case is disclosure of configuration files, credentials, and secrets that may enable follow-on attacks. Net: treat as a real patch priority given remote unauthenticated access and ColdFusion's attractiveness to attackers, while noting that real-world exploitation volume cannot be quantified from the data provided.

A remote, unauthenticated attacker submits a crafted XML document to a ColdFusion endpoint that parses XML with external entity resolution enabled, embedding an external entity that references a local file path. Because the attack is network-based, low-complexity, and requires no authentication or user interaction, the server resolves the entity and returns the contents of sensitive files (e.g., configuration or credential files) to the attacker. No public exploit is identified at time of analysis, but XXE primitives of this kind are well understood and straightforward to weaponize.