External risk intelligence

ColdFusion Code Injection Vulnerability Allows Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-106624

ColdFusion is a commercial application server platform typically deployed to host web applications and APIs. By design, these services are intended to be accessible over the network to process web requests, often positioning them as public-facing endpoints in standard web architecture.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in ColdFusion, a platform for building and deploying web applications. The issue involves improper control of code generation, potentially allowing attackers to execute arbitrary code without user interaction, which could lead to a significant compromise of systems. The primary concern is confirming if our deployed ColdFusion instances are relevant and potentially exposed.

Attackers can run unwanted code on affected systems.
This critical flaw demands awareness of its potential impact.
Confirm relevance and exposure for ColdFusion.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability in ColdFusion by sending a specially crafted request over the network to trigger code injection. This could allow them to execute arbitrary code with the privileges of the current user, potentially leading to a complete compromise of the affected system. The vulnerability is accessible without any prior authentication or user interaction.

No authentication or user interaction needed.
Triggered via specially crafted network requests.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected server in the context of the current user when supported by the advisory. This could lead to the compromise of the server's resources and any data it processes.

Server code execution.
Network-accessible server.
Compromise of server resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in ColdFusion could allow unauthenticated attackers to execute arbitrary code by exploiting an improper control of code generation. Given the external exposure and critical severity, teams responsible for application hosting and security must act swiftly. The first practical step is to identify all ColdFusion instances, confirm their exposure and business criticality, and then work with the accountable owners to prioritize and plan remediation.

Application and infrastructure owners should lead.
Verify ColdFusion instance exposure and criticality.
Plan coordinated remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ColdFusion?

ColdFusion is a commercial application server platform used by developers to build, deploy, and host dynamic web applications and APIs. It functions as a middleware layer that processes server-side code to generate web content, typically sitting between a web server and a database to manage user requests and business logic in standard web architectures.

What does the code injection weakness in CVE-2026-106624 mean?

This vulnerability is classified as Improper Control of Generation of Code (CWE-94). It means the software fails to properly sanitize or validate input, allowing an attacker to inject and execute their own unauthorized commands. Because the system treats this injected code as legitimate instructions, the attacker can force the application to perform actions it was never intended to do.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending a specially crafted request to the ColdFusion server over the network. The vulnerability does not require the attacker to have an existing account, nor does it require any user interaction—such as a click—to execute. Simply reaching the application via a network request is sufficient to initiate the flaw; it is not triggered by standard, benign site traffic.

Is my ColdFusion instance at risk?

Halo Surface Signal indicates that ColdFusion is commonly deployed as a public-facing endpoint to serve web content, which often puts it in the path of external network traffic. If your instance is internet-facing, it is likely reachable by attackers. Even if internal, any network-accessible instance may be a target for unauthorized code execution if the surrounding network is breached.

What should I do first to address this?

Begin by creating a comprehensive inventory to identify every ColdFusion instance in your environment. Once identified, confirm which instances are internet-facing versus internal to help prioritize risk. Coordinate with your application and infrastructure owners to assess the business criticality of each instance and prepare to apply the necessary updates from the vendor.

References

www.adobe.com/trust/security/products/coldfusion/apsb26-144.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.