CVE-2026-106621: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Adobe ColdFusion 2025

CVE-2026-106621 is a code injection vulnerability (CWE-94) in Adobe ColdFusion 2025 that allows remote attackers to execute arbitrary code without user interaction or privileges. The vulnerability stems from improper control of code generation, which can be exploited to run arbitrary code in the context of the current user. Affected versions include all releases up to 2025.0.13 and 2023.0.25. The CVSS 3.1 base score is 9.1, reflecting critical impact on confidentiality and integrity with no availability impact. There is no indication of known exploits in the wild. No vendor patch or advisory link was provided in the data.

Successful exploitation results in arbitrary code execution with the privileges of the ColdFusion process user, potentially leading to full system compromise depending on the user context. Confidentiality and integrity are severely impacted, while availability is not affected. No user interaction or privileges are required to exploit this vulnerability, increasing its risk.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Adobe's security advisories closely and apply updates once available. Until then, consider restricting network access to ColdFusion services and applying any recommended temporary mitigations from Adobe.