External risk intelligence

ColdFusion Code Injection Vulnerability Allows Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-106621

Adobe ColdFusion is a commercial application server commonly deployed to host web applications and public-facing APIs. As a server-side technology, it is frequently configured to be internet-accessible to serve web content, making its services and endpoints common targets for remote network-based interactions.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Adobe ColdFusion, a server-side technology used for building and deploying web applications. This flaw allows for code injection, potentially enabling an attacker to execute arbitrary commands without user interaction, which could lead to significant system compromise.

Code injection allows attackers to run commands.
It affects internet-facing web application servers.
Confirm relevance and exposure in your ColdFusion environment.

Attack Path

How an attacker could exploit the issue

An attacker can reach a code injection vulnerability in ColdFusion by accessing it over the network, with no special permissions or user interaction needed. This vulnerability could allow them to run their own commands on the server.

Accessible remotely over the network.
Triggers via code injection.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on systems running ColdFusion. When supported, an attacker could leverage this to run commands or code in the context of the application server, potentially affecting system operations and sensitive information.

System data and service behavior.
Remote, unauthenticated code execution.
Arbitrary code execution in the server context.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ColdFusion indicates a critical risk of arbitrary code execution, requiring immediate attention from teams responsible for application hosting and security. The first practical step involves identifying all ColdFusion instances, assessing their exposure and business criticality, and then locating the accountable system owner to coordinate a risk-based remediation plan.

Application and Infrastructure owners should triage.
Verify all ColdFusion instance reachability.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe ColdFusion?

Adobe ColdFusion is a commercial application server platform. It serves as an engine that processes CFML (ColdFusion Markup Language) to build, deploy, and host dynamic websites, web applications, and public-facing APIs.

What does the code injection vulnerability in CVE-2026-106621 mean?

This vulnerability, classified as CWE-94, occurs when the software improperly controls the generation of code. It allows an attacker to inject their own commands into the server, which the system then executes as if they were legitimate instructions.

How is this ColdFusion vulnerability triggered?

An attacker triggers this flaw by sending specially crafted requests over the network. It does not require any user interaction or prior authentication to execute. Normal, authorized interactions with the application do not trigger this specific flaw.

Do I need to worry about this if my server is internal?

Halo Surface Signal indicates that ColdFusion is commonly deployed as internet-facing technology. While internet-exposed servers face the highest risk, any system reachable over your network remains a potential target for this arbitrary code execution vulnerability.

When should I take action for this CVE?

You should prioritize this immediately. Start by identifying all active ColdFusion instances in your environment, determine which ones are reachable over the network, and coordinate with the system owners to initiate the remediation process.

References

www.adobe.com/trust/security/products/coldfusion/apsb26-144.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.