External risk intelligence

ColdFusion SSRF Vulnerability Allows Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-106622

ColdFusion is a commercial application server platform widely deployed to host public-facing web applications, APIs, and websites. Because it is specifically designed to handle and process web traffic, instances are commonly exposed to the internet in real-world environments.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Adobe ColdFusion that allows an attacker to potentially escalate privileges by tricking the server into making requests on their behalf. This type of attack, known as Server-Side Request Forgery, can have significant consequences without requiring any action from a user. The primary concern is to confirm if your ColdFusion environment is affected and understand the potential exposure.

The issue enables unauthorized access and control.
It affects widely used web application servers.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker can exploit this Server-Side Request Forgery vulnerability by sending a crafted request to an exposed ColdFusion instance. This can allow the attacker to cause the server to make requests to arbitrary locations, potentially leading to privilege escalation on the affected system without any user interaction. The vulnerability is exploitable because the server's scope is changed, allowing for broader access than intended.

No authentication required.
Crafted request triggers vulnerability.
Leads to privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

This Server-Side Request Forgery vulnerability in ColdFusion could allow an unauthenticated attacker to make the server send requests to arbitrary internal or external resources. This could lead to the server accessing sensitive internal services or revealing information about the network.

Server may access internal network resources.
Unauthenticated attacker can trigger requests.
Potential for unauthorized internal access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ColdFusion, a commercial application server platform, likely impacts teams responsible for public-facing web applications, APIs, and websites. The first practical step is to identify all ColdFusion instances, confirm their exposure and business criticality, and then assign ownership for remediation planning.

Application owners should own the issue.
Verify external reachability and impact.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe ColdFusion?

Adobe ColdFusion is a commercial application server platform used to build, deploy, and host dynamic websites, APIs, and complex web applications. It serves as a middleware layer that processes code and interacts with databases, making it a foundational component for many enterprise web environments.

What is the SSRF weakness in CVE-2026-106622?

This vulnerability is classified as CWE-918, or Server-Side Request Forgery (SSRF). It occurs when an application is tricked into making unauthorized requests to internal or external resources. By manipulating these requests, an attacker can bypass security controls to potentially escalate their privileges and gain unauthorized control over the server.

How does an attacker trigger this ColdFusion vulnerability?

An attacker triggers the vulnerability by sending a specially crafted web request to the server. The flaw does not require any interaction from a user, nor does it require authentication. It is important to note that simply visiting the site normally or performing standard administrative tasks does not trigger the bug; it requires a specific, malicious input designed to exploit the server's request-handling logic.

Is my ColdFusion instance at risk?

According to Halo Surface Signal, ColdFusion is frequently used for public-facing web applications and APIs, meaning these instances are often accessible from the internet. If your server is reachable from an external network, it may be at higher risk. You should evaluate whether your specific deployment is internet-facing or restricted to an internal network to determine the immediate relevance of this threat.

What should I do first to manage this CVE?

Start by identifying all active ColdFusion instances within your infrastructure. Once you have a complete inventory, verify which servers are accessible from the internet and prioritize those for review. Assign ownership of these assets to the relevant application teams so they can assess the business impact and prepare for necessary security updates or configuration changes.

References

www.adobe.com/trust/security/products/coldfusion/apsb26-144.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.