PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-106622 Adobe CVE debrief

A Server-Side Request Forgery (SSRF) vulnerability in Adobe ColdFusion could lead to privilege escalation. This CVE was published on 2026-10-13T20:21:42.047Z and was last modified on 2026-10-14T10:40:52.621Z. The vulnerability affects ColdFusion 2025 versions up to 2025.0.13 and ColdFusion 2023 versions up to 2023.0.25. Exploitation does not require user interaction. Defenders should verify exposure, assess update needs, and implement compensating controls if necessary. The SSRF vulnerability could result in significant operational impacts, including potential unauthorized access and privilege escalation.

Vendor
Adobe
Product
ColdFusion 2025
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-13
Original CVE updated
2026-10-14
Advisory published
2026-10-13
Advisory updated
2026-10-14

Who should care

Defenders responsible for Adobe ColdFusion deployments, especially those using affected versions, should assess exposure and prioritize updates or compensating controls to mitigate SSRF risks.

Why it matters

The SSRF vulnerability in Adobe ColdFusion could lead to privilege escalation, requiring defenders to verify exposure, assess update needs, and implement compensating controls if necessary.

  • Verification of ColdFusion deployment versions for exposure.
  • Potential need for updates to mitigate SSRF vulnerability.
  • Implementation of compensating controls if updates are not feasible.
  • Assessment of privilege escalation risks in ColdFusion environments.

Technical summary

The CVE record describes a critical SSRF vulnerability in Adobe ColdFusion that could result in privilege escalation. The vulnerability affects ColdFusion 2025 versions up to 2025.0.13 and ColdFusion 2023 versions up to 2023.0.25. Exploitation does not require user interaction.

Defensive priority

Defenders should prioritize verifying exposure of ColdFusion deployments, especially those using versions 2025.0.13 or earlier and 2023.0.25 or earlier, and assess the need for updates or compensating controls.

Recommended defensive actions

  • Verify ColdFusion deployments for exposure, especially versions 2025.0.13 or earlier and 2023.0.25 or earlier.
  • Assess the need for updates to ColdFusion 2025.0.14 or 2023.0.26.
  • Implement compensating controls to mitigate SSRF risks if updates are not immediately feasible.

Evidence notes

The CVE record and source item provide details on the SSRF vulnerability in Adobe ColdFusion, with references to vendor advisories for further information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-106622 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-106622

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-106622 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-106622

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/106xxx/CVE-2026-106622.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html

    Supplemental source - vendor-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.