{"id":"CVE-2026-106622","published":"2026-10-13T21:17:31.490","lastModified":"2026-10-15T18:30:37.370","description":"ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-918"],"vendors":["adobe"],"products":["coldfusion"],"references":[{"url":"https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"ColdFusion suffers from a Server-Side Request Forgery (SSRF) vulnerability that allows remote attackers to make server-side requests to internal resources, potentially leading to privilege escalation and unauthorized access to backend systems. This critical flaw can be exploited without user interaction, making it particularly dangerous.","exploitability":"The vulnerability is highly exploitable with no user interaction required, allowing attackers to perform SSRF attacks against internal services by crafting malicious requests that bypass normal access controls.","blast_radius":"If exploited, this vulnerability could enable attackers to access internal network resources, databases, and backend services that are typically not directly exposed to the internet, potentially leading to full system compromise and data exfiltration.","remediation":"No fixed version is published in the description, so implement network segmentation to restrict access to ColdFusion endpoints and disable unnecessary features that could be exploited for SSRF.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ssrf","coldfusion","privilege-escalation","remote-exploitation"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:45:14.569Z"}}