Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

ColdFusion allows attackers to make network requests as server

CVE-2026-106622 · published today
Summary

Adobe ColdFusion versions 2023 and 2025 can be tricked into sending internal network requests without any user action. This could let an attacker reach otherwise protected services and gain higher-level access. Apply Adobe’s latest security updates and restrict outbound traffic from the server.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe coldfusion 2025 <= 2025.0.13
adobe coldfusion 2023 <= 2023.0.25
Original advisory text
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-106622 · NVD
CVE-2026-106622 · MITRE
Track software like this
Free during beta