CVE-2026-106619: Improper Input Validation (CWE-20) in Adobe ColdFusion 2025

CVE-2026-106619 is an improper input validation vulnerability in Adobe ColdFusion 2025 that may lead to arbitrary code execution in the context of the current user. The flaw allows an attacker to execute code without requiring user interaction, though exploitation depends on external conditions. The vulnerability affects ColdFusion versions up to and including 2025.0.13 and 2023.0.25. The scope of the vulnerability is changed, indicating that the impact extends beyond the initially affected component. The CVSS v3.1 score is 9.0, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation could result in arbitrary code execution with the privileges of the current user, potentially leading to full compromise of the affected system. The vulnerability affects confidentiality, integrity, and availability at a high level. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Users should monitor Adobe's official advisories for updates and apply patches once available. Until then, consider restricting access to vulnerable ColdFusion instances and applying compensating controls as appropriate.