Adobe Security Bulletin

Last updated on Oct 13, 2026

Security update available for Adobe ColdFusion | APSB26-144

Bulletin ID

Date published

Priority

APSB26-144

October 13, 2026

style

grid width 12

Summary

Adobe has released a priority 2 security update for Adobe ColdFusion. This update addresses vulnerabilities rated critical, high, and medium that could result in arbitrary code execution, security feature bypass, arbitrary file system write, privilege escalation, arbitrary file system read, application denial-of-service, and memory exposure.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Versions

Product

Version

Platform

Adobe ColdFusion 2025

2025.0.13

All

Adobe ColdFusion 2023

2023.0.25

All

style

grid width 12

Solution

Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:

Product

Updated version

Platform

Priority rating

Installation instructions

Adobe ColdFusion 2025

2025.0.14

All

Release Notes

Adobe ColdFusion 2023

2023.0.26

All

Release Notes

style

grid width 12

Note

For security reasons, we strongly recommend using the latest mysql java connector. For more information on its usage, please refer to: https://helpx.adobe.com/coldfusion/kb/coldfusion-configuring-mysql-jdbc.html

See the updated serial filter documentation for more details on protection against insecure deserialization attacks: https://helpx.adobe.com/coldfusion/kb/coldfusion-serialfilter-file.html

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Vulnerability Details

CVE-2026-105899

Vulnerability category: Unrestricted Upload of File with Dangerous Type (CWE-434)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106622

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-105903

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106612

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106624

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-75994

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.6
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106620

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary file system write
Severity: Critical
CVSS base score: 9.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CVE-2026-90530

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.3
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106621

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE-2026-106619

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.0
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-105901

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106089

CVE-2026-106090

CVE-2026-106613

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-106615

CVE-2026-106617

CVE-2026-106618

CVE-2026-34634

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE-2026-105897

CVE-2026-106616

Vulnerability category: Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Vulnerability impact: Arbitrary file system read
Severity: High
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE-2026-71385

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.4
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE-2026-75995

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.4
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE-2026-105898

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CVE-2026-106614

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-34633

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE-2026-105994

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: High
CVSS base score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

CVE-2026-75748

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 7.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

CVE-2026-75996

Vulnerability category: Uncontrolled Resource Consumption (CWE-400)
Vulnerability impact: Application denial-of-service
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-105900

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Application denial-of-service
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-106623

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Memory exposure
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2026-76001

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 7.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

CVE-2026-48378

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Privilege escalation
Severity: Medium
CVSS base score: 5.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Note

Adobe recommends updating your ColdFusion JDK/JRE LTS version to the latest update release as a secure practice. The ColdFusion downloads page is regularly updated to include the latest Java installers for the JDK version your installation supports as per the matrices below.

For instructions on how to use an external JDK, view Change ColdFusion JVM.

Adobe also recommends applying the security configuration settings included in the ColdFusion Security documentation as well as review the respective Lockdown guides.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Acknowledgments

Adobe would like to thank the following researchers for reporting the relevant issues and for working with Adobe to help protect our customers:

nbxiglk (nbxiglk) — CVE-2026-71385
AnirudhAnand (a0xnirudh) — CVE-2026-105899, CVE-2026-75994
hritik — CVE-2026-106622
anonymous_blackzero — CVE-2026-105903, CVE-2026-106612, CVE-2026-106624, CVE-2026-106620, CVE-2026-106619, CVE-2026-106613, CVE-2026-106615, CVE-2026-106617, CVE-2026-106618, CVE-2026-106616, CVE-2026-75995, CVE-2026-105898, CVE-2026-106614, CVE-2026-105994
CVD — CVE-2026-90530
elite (e0x1337) — CVE-2026-106621
Sébastien Morin (smsecurity) — CVE-2026-106089
Matan Sandori (matans1) — CVE-2026-106090, CVE-2026-75996, CVE-2026-106623, CVE-2026-76001
Matan Sandori (matans1) and 2Bsecure — CVE-2026-105901, CVE-2026-105900
limit3d — CVE-2026-105897

NOTE: Adobe maintains a public bug bounty program through Intigriti. If you’re an external security researcher interested in identifying and responsibly reporting potential security vulnerabilities to Adobe, please visit the Adobe Bug Bounty Program for more information.

For more information, visit Adobe Security Bulletin and Advisories or email PSIRT@adobe.com.

CardTitle

APSB26-144

CardDescription

Priority 2 Security update

CardImage

Created

2026-10-13