Adobe ColdFusion CVE-2026-106619

Exploitation targets internet- or network-reachable Adobe ColdFusion instances running vulnerable builds (ColdFusion 2023 at or below 2023.0.25, or ColdFusion 2025 at or below 2025.0.13). No authentication (PR:N) and no user interaction (UI:N) are required. The primary LIMITING factor is the AC:H condition explicitly noted in the description - 'Exploit depends on conditions beyond the attacker's control' - meaning the attacker must win a race or encounter a specific server state/configuration, so exploitation is not guaranteed on demand. The description does not name a specific feature, protocol handler, or configuration toggle, so the exact triggering condition is not disclosed in the available data and should be confirmed against Adobe advisory APSB26-144.

This is a genuinely high-priority flaw, though with an important caveat. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.0) describes a network-reachable, unauthenticated, no-user-interaction code-execution bug with a changed scope and total CIA impact - on paper this is critical. The single tempering factor is AC:H, consistent with the description's statement that 'Exploit depends on conditions beyond the attacker's control,' meaning successful exploitation hinges on a race, a specific state, or environmental conditions the attacker cannot reliably force. Key exploitation-signal data is MISSING: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public POC is indicated - so exploitation status is 'no public exploit identified at time of analysis.' There is therefore no evidence of active exploitation to elevate this above its intrinsic CVSS rating, but ColdFusion's long history as a high-value RCE target means defenders should treat the network-exploitable RCE as a near-term patching priority rather than deferring on the strength of AC:H alone. No SSVC decision data was supplied in the input.

A remote, unauthenticated attacker sends crafted input to an exposed Adobe ColdFusion server (2023 ≤2023.0.25 or 2025 ≤2025.0.13), abusing improper input validation (CWE-20) to achieve arbitrary code execution in the context of the running ColdFusion user. Because the CVSS vector carries AC:H, success depends on conditions the attacker does not fully control, so exploitation may be intermittent rather than reliable on the first attempt. No public exploit code has been identified at the time of analysis.