{"id":"CVE-2026-106619","published":"2026-10-13T21:17:31.150","lastModified":"2026-10-15T18:30:28.007","description":"ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":["adobe"],"products":["coldfusion"],"references":[{"url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"ColdFusion suffers from improper input validation that allows attackers to execute arbitrary code as the current user, potentially leading to full system compromise. This vulnerability is particularly dangerous because it can be exploited without user interaction and affects Adobe ColdFusion applications.","exploitability":"Exploitation requires favorable conditions beyond the attacker's control but is achievable with minimal prerequisites; no user interaction is needed once the vulnerable input is processed.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on affected ColdFusion servers, potentially leading to complete system compromise and data exfiltration across all applications hosted on those servers.","remediation":"Upgrade to ColdFusion 2023.0.15 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","coldfusion","input-validation"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:51:47.244Z"}}