Is CVE-2026-106622 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106622 being exploited in the wild.

How severe is CVE-2026-106622?

Critical severity, with a CVSS score of 10, published 13 October 2026.

Which products and versions are affected?

Adobe ColdFusion 2025.0.13, 2023.0.25.

How is CVE-2026-106622 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-106622?

Check whether you run Adobe ColdFusion at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106622: Adobe ColdFusion server-side request forgery privilege escalation

CVE-2026-106622 · Severity: critical · CVSS 10 · Published 2026-10-13

Adobe ColdFusion, a widely-deployed web application platform, contains multiple critical vulnerabilities that could allow attackers to execute arbitrary code, escalate privileges, bypass security features, and read or write files on affected systems. Several of these flaws can be exploited without authentication or user interaction, posing immediate risk to organizations running affected versions.

Technologies: Adobe ColdFusion. Vendors: Adobe.

Quick answers

Is CVE-2026-106622 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106622 being exploited in the wild.
How severe is CVE-2026-106622?: Critical severity, with a CVSS score of 10, published 13 October 2026.
Which products and versions are affected?: Adobe ColdFusion 2025.0.13, 2023.0.25.
Is there a fix for CVE-2026-106622?: Yes: fixed in ColdFusion 2025.0.14, 2023.0.26. Until then: Adobe recommends using the latest MySQL Java connector and reviewing the updated serial filter documentation for protection against insecure deserialization attacks, available in the referenced knowledge base articles.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-13", "note": "Adobe released security update APSB26-144" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106622 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-106622?: Check whether you run Adobe ColdFusion at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ColdFusion 2025.0.14, 2023.0.26

Adobe recommends using the latest MySQL Java connector and reviewing the updated serial filter documentation for protection against insecure deserialization attacks, available in the referenced knowledge base articles.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-13", "note": "Adobe released security update APSB26-144" } ]

Technical details

ColdFusion 2025.0.13 and 2023.0.25 contain a server-side request forgery (SSRF) vulnerability (CVE-2026-106622) along with multiple code injection, authorization bypass, and path traversal flaws that collectively enable arbitrary code execution and privilege escalation. The SSRF and several code injection issues require no authentication or user interaction and are reachable over the network, allowing remote compromise of confidentiality, integrity, and availability.

Affected products

Adobe ColdFusion 2025.0.13, 2023.0.25

References

https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.