CVE-2026-106613: ColdFusion | Improper Input Validation (CWE-20)
Published Oct 13, 2026
·Updated
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
Affected Software
39 affected components
Adobe ColdFusion
Adobe ColdFusion=2023-update1
Adobe ColdFusion=2023-update10
Adobe ColdFusion=2023-update11
Adobe ColdFusion=2023-update12
Adobe ColdFusion=2023-update13
Adobe ColdFusion=2023-update14
Adobe ColdFusion=2023-update15
Adobe ColdFusion=2023-update16
Adobe ColdFusion=2023-update17
Adobe ColdFusion=2023-update18
Adobe ColdFusion=2023-update19
Adobe ColdFusion=2023-update2
Adobe ColdFusion=2023-update20
Adobe ColdFusion=2023-update21
Adobe ColdFusion=2023-update22
Adobe ColdFusion=2023-update23
Adobe ColdFusion=2023-update24
Adobe ColdFusion=2023-update25
Adobe ColdFusion=2023-update3
Adobe ColdFusion=2023-update4
Adobe ColdFusion=2023-update5
Adobe ColdFusion=2023-update6
Adobe ColdFusion=2023-update7
Adobe ColdFusion=2023-update8
Adobe ColdFusion=2023-update9
Adobe ColdFusion=2025-update1
Adobe ColdFusion=2025-update10
Adobe ColdFusion=2025-update11
Adobe ColdFusion=2025-update12
Adobe ColdFusion=2025-update13
Adobe ColdFusion=2025-update2
Adobe ColdFusion=2025-update3
Adobe ColdFusion=2025-update4
Adobe ColdFusion=2025-update5
Adobe ColdFusion=2025-update6
Adobe ColdFusion=2025-update7
Adobe ColdFusion=2025-update8
Adobe ColdFusion=2025-update9
Event History
Oct 13, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
CVE Published
via MITRE·08:21 PM
Data Sourced
via MITRE·08:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-105899
- CVE-2026-106622
- CVE-2026-105903
- CVE-2026-106612
- CVE-2026-106624
- CVE-2026-75994
- CVE-2026-106620
- CVE-2026-90530
- CVE-2026-106621
- CVE-2026-106619
- CVE-2026-105901
- CVE-2026-106089
- CVE-2026-106090
- CVE-2026-106615
- CVE-2026-106617
- CVE-2026-106618
- CVE-2026-34634
- CVE-2026-105897
- CVE-2026-106616
- CVE-2026-71385
- CVE-2026-75995
- CVE-2026-105898
- CVE-2026-106614
- CVE-2026-34633
- CVE-2026-105994
- CVE-2026-75748
- CVE-2026-75996
- CVE-2026-105900
- CVE-2026-106623
- CVE-2026-76001
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs low-privileged access. No user interaction is required for exploitation.
2
What is the impact if exploitation succeeds?
An attacker could execute arbitrary code in the context of the current user. The stated impact includes compromise of confidentiality, integrity, and availability.