Adobe ColdFusion 2023/2025 Patch Urgent: CVSS 10.0 Zero-Click RCE Vulnerability CVE-2026-106624 Discovered

Adobe has identified a critical security flaw in its ColdFusion application server software that permits remote code execution. The vulnerability, tracked as CVE-2026-106624, impacts specific versions of ColdFusion 2023 and 2025, leaving systems exposed to arbitrary code injection by attackers.

What happened

According to the National Vulnerability Database, Adobe ColdFusion contains an Improper Control of Generation of Code vulnerability. This flaw, classified under CWE-94, allows an attacker to execute arbitrary code within the context of the current user. The issue affects Adobe ColdFusion 2025 up to version 2025.0.13 and Adobe ColdFusion 2023 up to version 2023.0.25.

The National Vulnerability Database rates the severity of CVE-2026-106624 as Critical with a CVSS score of 10.0. The scope of the vulnerability is changed, meaning the impact affects more components than the vulnerable component itself. Attackers can exploit this issue to run unauthorized code on the server without requiring any interaction from a user.

This follows a similar critical finding reported earlier in the year. As Patch Gazette reported on 2026-10-13, Adobe ColdFusion was also affected by CVE-2026-105903, which enabled remote code execution without user interaction. That previous flaw allowed low-privileged attackers to execute arbitrary code, highlighting a recurring pattern of high-severity issues in the platform.

Why it matters

The CVSS 10.0 rating indicates a critical severity level for the vulnerability. Because exploitation does not require user interaction, attackers can target exposed servers directly. This allows for remote code execution without the need for user engagement.

Systems running the affected versions of ColdFusion 2023 and 2025 are subject to this vulnerability. The ability to execute arbitrary code in the context of the current user means that attackers can run code on the system. This type of remote code execution allows for unauthorized actions on the server.

What to watch

• Monitor official Adobe security advisories for patch availability.
• Check server logs for signs of unauthorized code execution.
• Verify current ColdFusion versions against the affected ranges.
• Watch for exploit attempts targeting the code injection vector.

Who needs to act first

Teams should prioritize systems that are directly accessible from the internet or untrusted networks. Exposed instances face higher exposure because attackers can reach them without internal network traversal. Organizations should isolate vulnerable servers from critical data stores while awaiting a fix. It is advisable to back up configurations before making any changes. Testing patches in a non-production environment helps prevent service disruptions. If a fix is not yet available, reducing the attack surface through network segmentation is the safest immediate step.

What to do and how to stay safe: Adobe ColdFusion

• Inventory all servers running Adobe ColdFusion to identify affected versions.
• Restrict network access to ColdFusion services using firewalls or security groups.
• Enable detailed logging to detect potential exploitation attempts early.
• Prepare to apply updates immediately once the vendor provides a fix.

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Adobe ColdFusion are affected by CVE-2026-106624?

The vulnerability affects Adobe ColdFusion 2025 up to 2025.0.13 and Adobe ColdFusion 2023 up to 2023.0.25.

Is a patch available for this vulnerability yet?

No fix has been confirmed yet in the provided source material.

Does exploiting this vulnerability require user interaction?

No, exploitation of this issue does not require user interaction.