CVE-2026-106619: ColdFusion | Improper Input Validation (CWE-20)
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need credentials or user interaction to exploit this issue?
No. The vulnerability is rated as requiring no privileges and no user interaction.
Can the issue be exploited remotely?
The attack vector is network-based, so an attacker can attempt exploitation over the network. However, successful exploitation depends on conditions beyond the attacker’s control.
What level of access could successful exploitation provide?
Successful exploitation could allow arbitrary code execution in the context of the current user. The reported impact includes high confidentiality, integrity, and availability effects, with changed scope.