How Does CVE-2026-106621 Threaten ColdFusion 2023 And 2025 Users With Remote Code Execution?

Adobe ColdFusion contains a severe code injection vulnerability that permits attackers to execute arbitrary code on affected servers. The National Vulnerability Database lists CVE-2026-106621 with a CVSS score of 9.1, classifying it as Critical. This flaw stems from improper control over code generation, categorized under CWE-94. Attackers can exploit this issue to run commands in the context of the current user, potentially taking full control of the application environment without needing any interaction from a legitimate user.

Which ColdFusion versions are affected?

The vulnerability impacts specific releases of Adobe ColdFusion. According to the NVD record, Adobe ColdFusion 2025 is affected up to version 2025.0.13. Similarly, Adobe ColdFusion 2023 is affected up to version 2023.0.25. Developers running these versions or earlier are exposed to this risk. Any installation using these specific release numbers or prior builds lacks the necessary controls to prevent this type of code injection attack.

How does the exploit work?

The flaw allows for improper control of code generation, which leads to code injection. An attacker can send crafted requests that the server interprets as executable code rather than data. Because exploitation does not require user interaction, the attack can be launched remotely against any exposed instance. The code runs in the context of the current user, meaning the attacker gains whatever permissions that user account holds on the system.

What is the severity rating?

The NVD assigns a CVSS score of 9.1 to CVE-2026-106621. This places the vulnerability in the Critical severity range. The high score reflects the ease of exploitation and the potential impact of arbitrary code execution. Security teams should treat this as an urgent matter, given that remote attackers can trigger the flaw without needing to trick a user into clicking a link or opening a file.

What is the current fix status?

The source material does not confirm the availability of a patch or update for CVE-2026-106621. Organizations running affected versions should monitor vendor announcements closely. Until an official fix is provided, administrators must consider mitigating the exposure of their ColdFusion instances to untrusted networks.

What analysts watch for

Teams usually monitor for unusual outbound connections from application servers, which may indicate command-and-control traffic. Analysts examine process trees for unexpected child processes spawned by the web server. They check for new scheduled tasks or service installations that persist after a reboot. Reviewing access logs for encoded payloads or unusual request patterns helps identify early exploitation attempts. Security operations centers often correlate these signals with known indicators of compromise to determine the scope of any breach.

Background: CVSS score

The CVSS score provides a standardized number to rank vulnerability severity. Small teams should use it to prioritize patches, but must adjust for business context. A high score does not always mean immediate danger if the affected component is isolated or unused.

Read the full guide: CVSS Scores Explained: What Small Teams Must Know

What to do and how to stay safe: Adobe ColdFusion

• Restrict network access to ColdFusion instances to trusted IP addresses only.
• Monitor server logs for unexpected code execution or unusual process activity.
• Verify that your ColdFusion version is not within the affected range listed above.
• Prepare to isolate affected systems immediately if signs of compromise appear.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does CVE-2026-106621 require user interaction to exploit?

No, the NVD states that exploitation of this issue does not require user interaction.

What is the CVSS score for this vulnerability?

The CVSS score is 9.1, which is rated as Critical.

Which ColdFusion versions are vulnerable?

Adobe ColdFusion 2025 up to 2025.0.13 and Adobe ColdFusion 2023 up to 2023.0.25 are affected.