Key points
- The vulnerability is rated CVSS 9.9 Critical by the National Vulnerability Database.
- Exploitation requires no user interaction and can be performed by low-privileged attackers.
- Affected versions include Adobe ColdFusion 2023 up to 2023.0.25 and 2025 up to 2025.0.13.
Adobe ColdFusion contains a critical security flaw that permits arbitrary code execution, according to the National Vulnerability Database. The issue stems from incorrect authorization checks within the application. This vulnerability allows attackers with low privileges to run commands on the server. Crucially, exploitation does not require any user interaction, making it accessible to remote attackers who can reach the service. Organizations running specific versions of ColdFusion 2023 and 2025 are directly exposed to this risk.
By the numbers
- CVSS 9.9: The severity score assigned to CVE-2026-106612 by the NVD.
- 2023.0.25: The highest affected version of Adobe ColdFusion 2023.
- 2025.0.13: The highest affected version of Adobe ColdFusion 2025.
What the figures mean
The CVSS score of 9.9 indicates a critical threat level, reflecting the ease of exploitation and the severe impact of arbitrary code execution. The absence of a user interaction requirement means attackers can automate scans and exploit attempts at scale. The wide range of affected versions, spanning both the 2023 and 2025 release lines, suggests that many organizations may still be running vulnerable builds. The "scope changed" designation in the NVD record highlights that the vulnerability impacts more than just the vulnerable component, potentially affecting other parts of the system or user context.
Operational impact
Managed service providers must immediately inventory all client environments running Adobe ColdFusion. Teams usually need to verify which specific versions are deployed against the affected list. Internal stakeholders, including security operations and infrastructure managers, should be alerted to the risk of unauthorized code execution.
Suppliers providing ColdFusion-based services should be contacted to confirm their patch status. Organizations must determine if their network segmentation prevents external access to these instances. Reviewing access logs for unusual activity is standard procedure in such events. Ensuring that low-privileged accounts are monitored can help detect exploitation attempts.
What to do and how to stay safe: Adobe ColdFusion
- Audit all servers to identify if Adobe ColdFusion 2023 versions up to 2023.0.25 or 2025 versions up to 2025.0.13 are installed.
- Restrict network access to ColdFusion instances to prevent unauthenticated external connections while a fix is sought.
- Monitor server logs for signs of unauthorized code execution or unusual activity from low-privileged accounts.
- Prepare to apply updates immediately once Adobe releases a confirmed patch for CVE-2026-106612.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Adobe ColdFusion versions are affected by CVE-2026-106612?
Adobe ColdFusion 2023 up to version 2023.0.25 and Adobe ColdFusion 2025 up to version 2025.0.13 are affected.
Does exploiting this vulnerability require user interaction?
No, exploitation of this issue does not require user interaction, according to the NVD record.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-106612 as Critical with a CVSS score of 9.9.
