Loading vulnerability…
Server-Side Request Forgery in Adobe ColdFusion Leading to Privilege Escalation
CVE-2026-105897 is a server-side request forgery vulnerability affecting Adobe ColdFusion 2023 releases before Update 26 and ColdFusion 2025 releases before Update 14 on all platforms. An unauthenticated network attacker can induce server-side requests that could lead to privilege escalation without user interaction. The vulnerability has changed security scope and is rated High with a CVSS v3 score of 8.6. The affected function and request-validation failure are not publicly specified in the available technical details.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could enable privilege escalation, with effects extending beyond the vulnerable component's security authority. The specific privileges obtainable and downstream systems affected are not specified. Arbitrary code execution is not established for this CVE.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is documented. Adobe's ColdFusion security configuration recommendations and Lockdown Guides provide general hardening guidance but are not established substitutes for applying this fix.
Patch, then assume compromise.
Install Adobe ColdFusion 2023 Update 26 (2023.0.26), ColdFusion 2025 Update 14 (2025.0.14), or a later supported release containing the fix, following Adobe security bulletin APSB26-144 and the applicable installation instructions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.