Loading vulnerability…
Authenticated Arbitrary Code Execution in Adobe ColdFusion
CVE-2026-106613 is an improper input validation vulnerability in Adobe ColdFusion 2023 before Update 26 and ColdFusion 2025 before Update 14, affecting all platforms. A low-privileged attacker can exploit the vulnerability over a network to execute arbitrary code in the context of the current user without user interaction. The vulnerability is rated High with a CVSS v3 score of 8.8. The affected function and precise input-validation failure have not been specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution with the permissions of the current user. This can compromise the confidentiality, integrity, and availability of data and resources accessible to that account. Execution with elevated privileges beyond that user context is not established.
If you can’t patch tonight, do this now.
No CVE-specific temporary workaround is documented. Adobe recommends applying ColdFusion security configuration settings and following the ColdFusion 2023 or 2025 Lockdown Guide as general hardening measures; these measures are not established substitutes for installing the security update.
Patch, then assume compromise.
Install Adobe ColdFusion 2023 Update 26 (2023.0.26), ColdFusion 2025 Update 14 (2025.0.14), or a later supported release containing the fix, following Adobe bulletin APSB26-144 and the applicable installation instructions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.