CVE-2026-105897: Server-Side Request Forgery (SSRF) (CWE-918) in Adobe ColdFusion 2025

CVE-2026-105897 is a Server-Side Request Forgery (SSRF) vulnerability in Adobe ColdFusion 2025 that allows an attacker to induce the server to make unauthorized requests. This vulnerability can be exploited without user interaction and results in privilege escalation with a changed scope, meaning the attacker can gain higher privileges than initially accessible. The vulnerability affects ColdFusion versions up to and including 2025.0.13 and 2023.0.25. The CVSS 3.1 base score is 8.6, reflecting a high-severity issue with network attack vector, low attack complexity, no privileges required, no user interaction, changed scope, and high confidentiality impact.

Successful exploitation of this SSRF vulnerability can lead to privilege escalation on the affected ColdFusion server, potentially allowing attackers to gain unauthorized access to sensitive resources or perform actions with elevated privileges. The vulnerability does not require user interaction and can be triggered remotely over the network. The confidentiality impact is high, but integrity and availability impacts are not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Users should monitor Adobe's official security advisories for updates and apply patches promptly once available.