Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
5934 articles · 249428 vulns · 37/41 feeds (7d)
← Back to list
9.1
CVE-2026-106621PATCHED
adobe · coldfusion

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

Description

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

Affected Products

VendorProductVersions
adobecoldfusion0, 0

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
adobecoldfusioncert_advisory90%

References

  • https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html(vendor-advisory)

Related News (3 articles)

Tier B
BSI Advisories9d ago
[NEU] [hoch] Adobe ColdFusion: Mehrere Schwachstellen
→ No new info (linked only)
Tier B
CERT-FR9d ago
Multiples vulnérabilités dans les produits Adobe (14 octobre 2026)
→ No new info (linked only)
Tier C
VulDB9d ago
CVE-2026-106621 | Adobe ColdFusion code injection
→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.19.1 CRITICAL
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA KEV❌ No
Actively exploited❌ No
Patch available
2025.0.142023.0.26
CWECWE-94
PublishedOct 13, 2026
Trending Score21
Source articles3
Independent3
Info Completeness0/14
Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

CRITICALCVE-2026-75650EXPKEV
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Trending: 103
CRITICALCVE-2026-103849
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Trending: 34
CRITICALCVE-2026-106622
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
Trending: 21
CRITICALCVE-2026-105899
ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
Trending: 21
CRITICALCVE-2026-106624
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Trending: 21

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Oct 13, 2026
Discovered by ZDM
Oct 13, 2026
Patch Available
Oct 14, 2026