CVE-2026-106622: ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
Published Oct 13, 2026
·Updated
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
40 affected components
Adobe ColdFusion
Adobe ColdFusion=2023-update1
Adobe ColdFusion=2023-update10
Adobe ColdFusion=2023-update11
Adobe ColdFusion=2023-update12
Adobe ColdFusion=2023-update13
Adobe ColdFusion=2023-update14
Adobe ColdFusion=2023-update15
Adobe ColdFusion=2023-update16
Adobe ColdFusion=2023-update17
Adobe ColdFusion=2023-update18
Adobe ColdFusion=2023-update19
Adobe ColdFusion=2023-update2
Adobe ColdFusion=2023-update20
Adobe ColdFusion=2023-update21
Adobe ColdFusion=2023-update22
Adobe ColdFusion=2023-update23
Adobe ColdFusion=2023-update24
Adobe ColdFusion=2023-update25
Adobe ColdFusion=2023-update3
Adobe ColdFusion=2023-update4
Adobe ColdFusion=2023-update5
Adobe ColdFusion=2023-update6
Adobe ColdFusion=2023-update7
Adobe ColdFusion=2023-update8
Adobe ColdFusion=2023-update9
Adobe ColdFusion=2025-update1
Adobe ColdFusion=2025-update10
Adobe ColdFusion=2025-update11
Adobe ColdFusion=2025-update12
Adobe ColdFusion=2025-update13
Adobe ColdFusion=2025-update14
Adobe ColdFusion=2025-update2
Adobe ColdFusion=2025-update3
Adobe ColdFusion=2025-update4
Adobe ColdFusion=2025-update5
Adobe ColdFusion=2025-update6
Adobe ColdFusion=2025-update7
Adobe ColdFusion=2025-update8
Adobe ColdFusion=2025-update9
Event History
Oct 13, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
CVE Published
via MITRE·08:21 PM
Data Sourced
via MITRE·08:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-105899
- CVE-2026-105903
- CVE-2026-106612
- CVE-2026-106624
- CVE-2026-75994
- CVE-2026-106620
- CVE-2026-90530
- CVE-2026-106621
- CVE-2026-106619
- CVE-2026-105901
- CVE-2026-106089
- CVE-2026-106090
- CVE-2026-106613
- CVE-2026-106615
- CVE-2026-106617
- CVE-2026-106618
- CVE-2026-34634
- CVE-2026-105897
- CVE-2026-106616
- CVE-2026-71385
- CVE-2026-75995
- CVE-2026-105898
- CVE-2026-106614
- CVE-2026-34633
- CVE-2026-105994
- CVE-2026-75748
- CVE-2026-75996
- CVE-2026-105900
- CVE-2026-106623
- CVE-2026-76001
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The provided vector indicates that exploitation is network-accessible, has low attack complexity, requires no privileges, and requires no user interaction.
2
What impact could successful exploitation have?
The issue could result in privilege escalation. The supplied severity vector indicates high potential impact to confidentiality, integrity, and availability, with scope changed.
3
How can I determine whether my environment is affected?
The affected software identified in the available data is Adobe ColdFusion. No affected version range, configuration requirement, or detection method is provided.