Adobe ColdFusion: 25 Critical Vulnerabilities Disclosed in Single Batch
Adobe ColdFusion users face critical security risks as 25 vulnerabilities, including code execution and SSRF flaws, were disclosed simultaneously on October 13, 2026.
Key findings
- Adobe ColdFusion: 25 vulnerabilities disclosed on October 13, 2026.
- Flaws include critical code injection, SSRF, and authorization bypass vulnerabilities.
- Multiple CVEs allow arbitrary code execution with low privileges.
- Server-Side Request Forgery (SSRF) vulnerabilities could lead to privilege escalation.
- Immediate patching and security review are critical for all ColdFusion users.
On October 13, 2026, Adobe disclosed a significant batch of 25 vulnerabilities affecting its ColdFusion application server. These vulnerabilities, all published on the same day, span a range of critical and high severity flaws, including arbitrary code execution, server-side request forgery (SSRF), and denial-of-service (DoS) conditions. The sheer volume and severity of these issues highlight a critical security posture for ColdFusion users, demanding immediate attention and patching.
Several vulnerabilities revolve around Incorrect Authorization, allowing attackers to achieve arbitrary code execution or bypass security features. CVE-2026-75994, with a CVSSv3 score of 9.6, and CVE-2026-106620 (CVSSv3 9.6) specifically mention bypassing security measures for unauthorized write access, with some requiring only low privileges. Other notable authorization flaws include CVE-2026-106618, CVE-2026-106615, CVE-2026-106090, and CVE-2026-106089, all rated High with CVSSv3 scores of 8.8, enabling arbitrary code execution for low-privileged attackers.
Arbitrary Code Execution is a recurring theme, facilitated by various vulnerability types. CVE-2026-106624 (CVSSv3 10.0) and CVE-2026-105903 (CVSSv3 9.9) are critical 'Code Injection' vulnerabilities. CVE-2026-75995 (CVSSv3 8.4) and CVE-2026-106619 (CVSSv3 9.0) are Improper Input Validation flaws that could lead to code execution, with some requiring high privileges or depending on external conditions.
Server-Side Request Forgery (SSRF) vulnerabilities present a significant risk, potentially leading to privilege escalation and access to internal resources. CVE-2026-76001 (CVSSv3 7.1), CVE-2026-34634 (CVSSv3 8.6), and CVE-2026-34633 (CVSSv3 7.7) are identified as SSRF flaws that could allow privilege escalation. CVE-2026-106622, a critical SSRF vulnerability (CVSSv3 10.0), also falls into this category, with exploitation not requiring user interaction and potentially changing the scope of access.
Beyond code execution and SSRF, other vulnerabilities include Uncontrolled Resource Consumption, such as CVE-2026-75996 (CVSSv3 7.5), which can lead to application denial-of-service. Additionally, CVE-2026-106616 (CVSSv3 8.6) is an Improper Restriction of XML External Entity Reference ('XXE') vulnerability, allowing arbitrary file system reads.
Adobe has released security advisories detailing these vulnerabilities and providing patches. Users are strongly urged to consult Adobe's official advisories and apply the necessary updates to mitigate the risks associated with these critical flaws. The simultaneous disclosure of such a large number of severe vulnerabilities underscores the importance of maintaining up-to-date security configurations and promptly applying patches for Adobe ColdFusion.
The broad impact of these vulnerabilities, ranging from denial-of-service to complete system compromise through arbitrary code execution, necessitates a swift response from all ColdFusion administrators. Staying informed through Adobe's security bulletins and prioritizing the application of patches will be crucial in safeguarding affected systems.
The batch includes: CVE-2026-76001, CVE-2026-75996, CVE-2026-75995, CVE-2026-75994, CVE-2026-75748, CVE-2026-71385, CVE-2026-34634, CVE-2026-34633, CVE-2026-106624, CVE-2026-106623, CVE-2026-106622, CVE-2026-106621, CVE-2026-106620, CVE-2026-106619, CVE-2026-106618, CVE-2026-106617, CVE-2026-106616, CVE-2026-106615, CVE-2026-106614, CVE-2026-106613, CVE-2026-106612, CVE-2026-106090, CVE-2026-106089, CVE-2026-105994, CVE-2026-105903.