What is the CVSS score of CVE-2026-106624?

CVE-2026-106624 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

How to fix or mitigate CVE-2026-106624?

Within 24 hours, inventory every Adobe ColdFusion deployment and confirm which instances run 2023 (up to and including 2023.0.25) or 2025 (up to and including 2025.0.13); for any instance reachable from the internet or untrusted networks, immediately restrict that reachability at the network layer and put WAF protections in front of it, enable verbose logging, and confirm monitoring is capturing requests to the ColdFusion service. Within 7 days, move the service out of unauthenticated exposure altogether by segmenting it behind trusted networks, limiting administrative access to a dedicated management path, running the ColdFusion process under a least-privilege account, and reviewing logs and indicators for anomalous request patterns; subscribe to Adobe's security advisory feed so patch availability is detected the moment it changes. Within 30 days, apply the Adobe vendor-released patch to 2023 and 2025 lines as soon as it ships, prioritising internet-facing instances for immediate emergency change, and where patching cannot be completed keep the segmentation and WAF controls in place, document the residual risk, and escalate to architecture review to plan migration or version remediation.

Adobe ColdFusion CVE-2026-106624

EUVD-2026-100664 CRITICAL

Code Injection (CWE-94)

2026-10-13 psirt@adobe.com

GHSA-5pvv-hp6h-6688

RCE Code Injection Adobe Coldfusion

10.0

CVSS 3.1 · Vendor: adobe

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify exposed ColdFusion server
Delivery

Send crafted request with injected code
Exploit

Trigger code evaluation (CWE-94)
Execution

Execute arbitrary code as current user
Impact

Scope change compromises adjacent components

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required - remote unauthenticated exploitation is possible against reachable Adobe ColdFusion 2023 (≤2023.0.25) and 2025 (≤2025.0.13) instances, with no user interaction needed. The practical limiting factor is network reachability of the vulnerable ColdFusion service: an attacker must be able to reach the application server's exposed endpoint, so instances behind restrictive network segmentation or a WAF are harder to hit. The description does not name a specific non-default feature or configuration prerequisite, so exploitation appears to affect standard deployments within the listed version ranges; verify the exact affected configuration against Adobe advisory APSB26-144.
Impact	This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) and 10.0 score align consistently with the description: a CWE-94 code-injection flaw yielding arbitrary code execution, remotely exploitable at low complexity with no privileges and no user interaction, and a changed scope indicating impact beyond the vulnerable component. All impact metrics are High (C:H/I:H/A:H). Adobe ColdFusion application servers have a long, well-documented history of being targeted for RCE, which raises the practical threat regardless of current exploitation telemetry. Key signals are MISSING and must be stated explicitly: no EPSS score, no SSVC decision data, no CISA KEV listing, and no POC indicator were provided in the input, so exploitation likelihood cannot be quantified - the assessment rests on the CVSS vector, CWE, and product history alone. The CVSS vector and description are mutually consistent (no conflict to reconcile). Bottom line: treat as critical and patch urgently given the unauthenticated-RCE profile on a frequently attacked enterprise product, while recognizing that active-exploitation status is unconfirmed in the available data.
Exploit ScenarioDerived	A remote, unauthenticated attacker sends a crafted request to an internet-facing ColdFusion server that reaches a vulnerable code-evaluation path, injecting code that the server executes in the context of the current user. Because no authentication or user interaction is required and attack complexity is low, exploitation can be fully automated against exposed instances. No public exploit was identified in the provided data at the time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 1.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 13, 2026

Unauthenticated remote code execution in Adobe ColdFusion 2023 (versions up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows any remote attacker who can reach the service to execute arbitrary code under the context of the ColdFusion process, with no user interaction required. The CVSS 3.1 base score is a maximum 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the Scope:Changed metric indicates the attacker's actions can escape the vulnerable component and affect resources beyond its intended security boundary - typically the underlying JVM or host operating system. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so this is a high-severity, top-priority patching case driven by the attack vector and impact ratings rather than by confirmed active exploitation; the practical gating factor is network reachability of the exposed ColdFusion endpoint, with WAF-protected or segmented deployments materially harder to attack.

RemediationAI

Primary action is to upgrade the affected ColdFusion instance to the fixed release identified in Adobe's security bulletin for this CVE, APSB26-144 (https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html), which is the authoritative source for the corrected build numbers for the 2023 and 2025 release trains; because the available intelligence does not specify a fixed version string, verify the exact patched build in that advisory rather than relying on a version number quoted elsewhere. No vendor-released patch version was confirmed in the supplied data, so if an upgrade cannot be applied immediately, prioritize compensating controls that reduce the unauthenticated network attack surface: restrict access to the ColdFusion service with firewall rules or a reverse proxy so that only trusted networks or administrative IP ranges can reach it (trade-off: may break legitimate external application access and requires maintaining allowlists), place the instance behind a WAF with virtual patching for code-injection and template-evaluation patterns (trade-off: WAF coverage is signature-dependent and can be bypassed with encoding tricks), disable and block access to unused administrative and development endpoints such as /CFIDE/administrator and /CFIDE/scripts and remove any RDS or debugging features not absolutely required (trade-off: some administrative and developer workflows will stop functioning), and run the ColdFusion service under a least-privileged OS account with constrained filesystem and network egress permissions to limit post-exploitation impact (trade-off: may require re-permissioning and can break integrations relying on broader access). Monitor web and application logs for anomalous template or expression evaluation requests against the affected endpoints, and treat any suspicious code-execution activity as a potential compromise requiring host-level incident response.

Affected VersionsENISA

ColdFusion 2023 0 ≤2023.0.25

ColdFusion 2025 0 ≤2025.0.13

Affected Packages

euvd coldfusion_2023 no fix

euvd coldfusion_2025 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Adobe ColdFusion is a Java-based rapid application development platform and application server that exposes web endpoints, administrative interfaces, and its own scripting/templating runtime on top of the JVM. CVE-2026-106624 is classified as CWE-94, Improper Control of Generation of Code ('Code Injection'), meaning the product fails to neutralize attacker-supplied input before using it to construct executable code - the classic pattern where untrusted data is concatenated into a template, expression, or script evaluation path and then executed by the runtime. Because the injected code executes inside the ColdFusion server process, successful exploitation yields code execution at the privilege level of the service account hosting ColdFusion. The CVSS vector confirms full confidentiality, integrity, and availability impact (C:H/I:H/A:H) with Scope:Changed, consistent with an attacker pivoting from the web tier to the JVM/OS. The vector shows AV:N/AC:L/PR:N/UI:N, so per the assessed data no authentication or user interaction is required, and the vulnerability is reachable over the network; the source data does not name a specific non-default feature or configuration prerequisite, so standard deployments within the listed version ranges should be treated as exposed. No CPE strings were supplied in the available intelligence, so product identification relies on the vendor advisory (Adobe APSB26-144) and the EUVD-2026-100664 affected-version list rather than on structured CPE matching.

Know when Coldfusion gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (adobe) PRIMARY 10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI 10.0 CRITICAL

Remote code injection needing no auth or interaction gives AV:N/AC:L/PR:N/UI:N; arbitrary code execution with a stated scope change yields S:C and full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Executive ViewAI

Why It Matters

A maximum-severity, unauthenticated remote code execution flaw affects Adobe ColdFusion 2023 (through 2023.0.25) and ColdFusion 2025 (through 2025.0.13), allowing any attacker who can reach the service to run arbitrary code as the ColdFusion process - and potentially beyond it onto the underlying JVM or host - without credentials or user interaction. No vendor patch is available yet, so any internet-facing or broadly reachable ColdFusion instance is a direct path to compromise of the applications and data it hosts. Leadership should treat this as a top-priority exposure-reduction effort, with the practical gating factor being who can actually reach the service.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: eliminate network reachability of the ColdFusion service from untrusted networks (including internet-facing exposure), front the service with a WAF, isolate the service and its underlying JVM or host through network segmentation and least-privilege service accounts, and monitor service logs for anomalous requests.

Threat Intelligence Overview

EPSS Score

1.1%

Top 35% exploitable

Prevalence

High

widely deployed Adobe enterprise application server, common in enterprises

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 1.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +50

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.