Adobe ColdFusion APSB26-144: 31 CVEs including three CVSS 10.0 flaws that need no login (CVE-2026-105899 file upload to code execution, CVE-2026-106624 code injection, CVE-2026-106622 SSRF); fixed in ColdFusion 2025.0.14 and 2023.0.26

Adobe released security bulletin APSB26-144 for ColdFusion on 13 October 2026, its October Patch Tuesday, with 31 CVE records published the same day by Adobe as the CVE numbering authority. Three are scored 10.0 (CVSS 3.1: network, low complexity, no privileges, no user interaction, scope changed): CVE-2026-105899, an unrestricted upload of a dangerous file type that Adobe says could lead to arbitrary code execution; CVE-2026-106624, a code-injection flaw leading to arbitrary code execution; and CVE-2026-106622, a server-side request forgery (SSRF) flaw that could lead to privilege escalation. Two more, CVE-2026-105903 (code injection) and CVE-2026-106612 (incorrect authorisation), are scored 9.9 and need only a low-privileged account. Others in the bulletin include CVE-2026-106621 (9.1, code injection without authentication), CVE-2026-106619 (9.0, input validation, high attack complexity), CVE-2026-106620 (9.6, authorisation bypass giving write access), CVE-2026-75994 (9.6, code execution from the administrative network zone), CVE-2026-90530 (9.3, path traversal in the RDS developer feature), and a long list of 7.1 to 8.8 authorisation, SSRF, XXE and denial-of-service bugs. Adobe's CVE records list ColdFusion 2025 up to 2025.0.13 and ColdFusion 2023 up to 2023.0.25 as affected, fixed in 2025.0.14 and 2023.0.26. The record for CVE-2026-90530 notes that RDS is a development feature that the Production Secure Profile disables automatically. We found no reports of exploitation, and none of these CVEs is in CISA's Known Exploited Vulnerabilities catalog as of 20 October, but internet-facing ColdFusion servers have been exploited quickly after past bulletins, so treat this as urgent. Details come from Adobe's CVE records; Adobe's bulletin page refused our fetch. Primary: Adobe APSB26-144 and Adobe CVE records.

Product

Adobe ColdFusion 2025 and ColdFusion 2023 (application server)

Versions

ColdFusion 2025 up to 2025.0.13 and ColdFusion 2023 up to 2023.0.25 affected. Fixed: 2025.0.14 and 2023.0.26 (per Adobe's CVE records).

CVSS

10.0 (CVSS 3.1, Adobe) for CVE-2026-105899, CVE-2026-106624 and CVE-2026-106622; 9.9 for CVE-2026-105903 and CVE-2026-106612

Exploited in Australia?

unknown

Patch to

Update ColdFusion 2025 to 2025.0.14 and ColdFusion 2023 to 2023.0.26 or later now, including staging and developer servers. Make sure the ColdFusion Administrator, RDS and other admin paths are not reachable from the internet, run production servers with the Production Secure Profile (which disables RDS) and follow Adobe's ColdFusion lockdown guide. Check web roots and upload folders for unexpected .cfm, .cfc or .jsp files, and review outbound requests from ColdFusion hosts for SSRF abuse. Practitioner page: /knowledge/vulnerability-management.

Primary: Adobe — APSB26-144 Security updates available for Adobe ColdFusion (13 Oct 2026) · Vendor: CVE record — CVE-2026-105899 ColdFusion unrestricted upload of file with dangerous type (Adobe CNA; CVSS 10.0; 13 Oct 2026) · CVE: CVE-2026-105899, CVE-2026-106624, CVE-2026-106622, CVE-2026-105903, CVE-2026-106612, CVE-2026-106621, CVE-2026-106619, CVE-2026-106620, CVE-2026-75994, CVE-2026-90530 · NVD — CVE-2026-106624 ColdFusion code injection (Adobe CVSS 10.0; published 13 Oct 2026)

vulnerabilities