Adobe ColdFusion CVE-2026-106621

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special complexity are required against affected default deployments of Adobe ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13); the primary prerequisite is network reachability of a vulnerable ColdFusion instance. The description does not name a specific feature, protocol, or non-default configuration toggle, so the exact vulnerable code path is not disclosed in the available data. The main limiting factor is the impact scope: code executes 'in the context of the current user' (the ColdFusion service account), which bounds the attacker's privileges to that account rather than guaranteeing OS-level administrative control.

This is a high-priority vulnerability that warrants expedited patching. The CVSS 9.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity code-injection flaw (CWE-94) requiring no user interaction - the worst-case precondition profile short of wormability. Adobe ColdFusion has a long, well-documented history of post-disclosure mass exploitation (multiple prior ColdFusion CVEs have reached CISA KEV), so the base-rate risk for this product class is elevated even though exploitation-specific telemetry is absent here. Signals are, however, incomplete and should not be overstated: no EPSS probability was supplied, there is no CISA KEV listing, and no public POC is referenced, so there is no public exploit identified at time of analysis. One internal inconsistency to verify: the CVSS vector sets A:H to N while describing 'arbitrary code execution' - full code execution would normally imply an availability impact, so Adobe likely scoped A:N because execution occurs 'in the context of the current user' (a constrained service account) rather than root/SYSTEM; confirm the intended privilege context with Adobe APSB26-144. Net: treat as a genuine priority on exposure and product history, not merely a high-CVSS-but-low-real-risk issue, while recognizing exploitation evidence is not yet available.

An internet-facing Adobe ColdFusion 2023 (≤2023.0.25) or 2025 (≤2025.0.13) application server receives a crafted request from a remote, unauthenticated attacker that injects attacker-controlled code into a dynamic code-generation/evaluation path. The injected code executes server-side in the context of the ColdFusion service account, giving the attacker command execution to read application data or stage further compromise. No public exploit code is identified at time of analysis, but ColdFusion RCE flaws are historically weaponized quickly after disclosure.