CVE-2026-106616: Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) in Adobe ColdFusion 2025

CVE-2026-106616 is an Improper Restriction of XML External Entity Reference (XXE) vulnerability in Adobe ColdFusion 2025. This vulnerability enables an attacker to exploit XML processing to read arbitrary files on the file system outside the intended access scope. The flaw does not require user interaction and affects ColdFusion versions up to and including 2025.0.13 and 2023.0.25. The vulnerability has a CVSS v3.1 base score of 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, changed scope, and high confidentiality impact.

Successful exploitation allows an attacker to read sensitive files and directories on the affected system, potentially exposing confidential information. The vulnerability does not impact integrity or availability but compromises confidentiality. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Users should monitor Adobe's official security advisories for updates and apply patches promptly once available.