ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
References
| Link | Resource |
|---|---|
| https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Oct 2026, 18:30
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update13:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update14:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update25:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update24:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:* cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:* |
|
| References | () https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html - Vendor Advisory | |
| First Time |
Adobe
Adobe coldfusion |
13 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-13 21:17
Updated : 2026-10-15 18:30
NVD link : CVE-2026-106621
Mitre link : CVE-2026-106621
CVE.ORG link : CVE-2026-106621
JSON object : View
Products Affected
adobe
- coldfusion
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')