Patching

Adobe released security bulletin APSB26-144 on October 13, fixing 32 vulnerabilities in ColdFusion 2025 and ColdFusion 2023. Ten are rated critical, 21 high and one medium. The two worst, an unrestricted file upload and a server-side request forgery, score the maximum CVSS 10.0 and need no account. If you run ColdFusion 2025 at 2025.0.13 or earlier, or ColdFusion 2023 at 2023.0.25 or earlier, you are affected.

Adobe says it knows of no exploitation yet. ColdFusion has a record of being attacked soon after fixes ship, though: in 2023 attackers used CVE-2023-26360 to get into at least two public-facing servers at a US federal civilian agency, months after the patch and the federal deadline had passed. The Zero Day Initiative (ZDI), which reviews each month's patches, called this bulletin the one it would treat as most urgent of the month.

What Adobe shipped this month

ColdFusion was one bulletin in a wider Adobe release that also covered Commerce, Photoshop, Substance 3D, Dimension, FrameMaker and Bridge. The counts differ by source: SecurityWeek reports 10 new advisories covering roughly 140 vulnerabilities, while ZDI counts 11 bulletins and 174 unique CVEs. ColdFusion's 32 are the same in every count.

The priority rating is also inconsistent. Adobe's priority scale runs from 1 (act within 72 hours) through 2 (within 30 days) to 3 (at the admin's discretion). The summary of APSB26-144 says priority 2, and ZDI repeats that, but the version table in the same bulletin marks both fixed releases as priority 1. SecurityWeek wrote that only the Commerce advisory was rated priority 2. Given the scores, we would act on the bulletin as priority 1.

How the flaws work

The ten critical CVEs fall into a few groups, and the group tells you how an attacker would use each one.

File upload and code injection. CVE-2026-105899 (CVSS 10.0) is an unrestricted upload of a file with a dangerous type. On a ColdFusion server that is close to a direct path to code execution, because a .cfm file placed somewhere the server will serve it runs as soon as it is requested. Two code injection flaws sit next to it: CVE-2026-105903 (9.9) needs a low-privilege account, while CVE-2026-106621 (9.1) needs none and leads to privilege escalation.

Server-side request forgery (SSRF). In an SSRF the attacker makes the server send requests on their behalf, usually to addresses only the server can reach: internal admin pages, other hosts on the private network, or the cloud metadata service that hands out instance credentials. CVE-2026-106622 scores 10.0 because it needs no login and its impact reaches beyond ColdFusion itself. The bulletin lists six more SSRF flaws, rated 5.0 to 8.6.

Broken authorization checks. Incorrect authorization (CWE-863) is the most common weakness in the bulletin. CVE-2026-106612 (9.9) gives code execution to any low-privilege user, CVE-2026-106620 (9.6) lets one write arbitrary files, and CVE-2026-75994 (9.6) needs no account but does need the attacker on an adjacent network. The remaining critical flaws are two input validation bugs (CVE-2026-106624 at 9.8 and CVE-2026-106619 at 9.0, both without login) and a path traversal, CVE-2026-90530 (9.3), that needs local access.

Adobe has not published a technical write-up of any of the flaws. The update's tech notes still show where the holes were, because each fix arrives as a tighter default. ColdFusion now enforces an outbound network policy on server-initiated requests from cfdocument, cffeed, cfimage, GraphQL, MCP and SOAP calls, blocking private ranges, link-local addresses and metadata services, including after redirects. WebSocket clients must authenticate before invoking CFC methods. Report templates load only from the calling template's directory tree or an allowlisted path. Native C++ CFX libraries are blocked unless listed in cf_root/lib/pathfilter.json, and MCP STDIO commands run only from an allowlist that starts empty.

What to do

1. Update to the fixed release. ColdFusion 2025 goes to Update 14 (2025.0.14) and ColdFusion 2023 to Update 26 (2023.0.26). In the ColdFusion Administrator, open Package Manager, then Packages, click Check for Updates under Core Server, install, and restart. For offline servers, Adobe's tech note gives the hotfix JAR and says to run it with the JRE bundled with ColdFusion. On JEE deployments, stop every instance first.
2. Read the tech note before patching production, because the new defaults will break code that relied on the old behaviour. A cfdocument or cffeed request to an internal host now fails until you add it to an allowList, either in Application.cfc or server-wide in security-settings.json. Unauthenticated WebSocket calls to CFCs are refused unless an application sets this.wsRequireAuthForInvoke = false. Test those paths on staging.
3. If you cannot patch today, shrink the attack surface. Block /CFIDE/ at the web server connector (the uriworkermap.properties file), which the US Defense Information Systems Agency's ColdFusion hardening guide (STIG) requires. Firewall the built-in web server port, 8500 by default, which serves the Administrator even when the connector blocks it. Restrict the Administrator to admin IP addresses. None of this fixes the upload or SSRF bugs in your application paths; it removes the easiest targets.
4. Before patching, check whether you were already hit. Compare the web root and CFIDE against a known-good copy and look for new or changed .cfm, .cfc and .jsp files, the types a web shell on a ColdFusion server would use. Look for uploads in directories the server can execute from, Administrator logins from addresses you do not recognise, and outbound connections from the ColdFusion Java process to the internet or to 169.254.169.254, the cloud metadata address.
5. If you find anything, treat the host as compromised. Rebuild it on a fixed release rather than cleaning it in place. Rotate the Administrator and RDS passwords, every datasource credential stored in ColdFusion, and any cloud keys the instance's role could reach through the metadata service.

ColdFusion 2021 and older get nothing from this bulletin. ColdFusion 2021 left core support on November 10, 2025, so the only fix is migrating to 2023 or 2025. Treat any 2021 server still on the internet as exposed to all of these flaws.

Keep the new defaults switched on

Each new protection in this update has a JVM flag that turns it off, such as -Dcoldfusion.security.ssrf.disableProtection=true or -Dcoldfusion.rds.security.disableFileProtection=true. When an application breaks after the update, the quick fix is to set one of those flags and move on, which puts the SSRF exposure straight back. Fix the application instead by adding the specific destinations it needs to the allowList. Adobe also documents one known gap: the outbound policy checks only the top-level URL cfdocument fetches, not images, stylesheets or iframes inside the HTML it renders. Until that is fixed, Adobe advises against rendering untrusted HTML with cfdocument and recommends blocking the server's access to internal and metadata endpoints at the network level.

After updating, Adobe recommends moving to the latest long-term support JDK release, using the latest MySQL Java connector, and reviewing the Lockdown Guide for your version.

If you are not sure how many ColdFusion servers you have or which ones face the internet, our attack surface management work finds them, and our web penetration testing team can test a patched application for the upload and SSRF paths. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Adobe APSB26-144, Adobe ColdFusion blog, ColdFusion 2025 Update 14 tech note, ColdFusion 2023 Update 26 tech note, SecurityWeek, Zero Day Initiative, Ivanti, CISA AA23-339A, Adobe on ColdFusion 2021 end of support, DISA STIG V-279111.