CVE-2026-106622: Server-Side Request Forgery (SSRF) (CWE-918) in Adobe ColdFusion 2025

CVE-2026-106622 is a Server-Side Request Forgery (SSRF) vulnerability in Adobe ColdFusion 2025 that allows an attacker to induce the server to make unauthorized requests. This vulnerability can be exploited without any user interaction and results in privilege escalation with a changed scope, meaning the attacker can gain higher privileges than initially accessible. The vulnerability has a CVSS v3.1 base score of 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this SSRF vulnerability can lead to full system compromise through privilege escalation. The attacker can potentially access sensitive internal resources, modify data, and disrupt service availability. The changed scope means the attacker's privileges extend beyond the original vulnerable component, increasing the severity of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official advisories are provided, users should monitor Adobe's security advisories for updates. Until a fix is available, restrict network access to ColdFusion servers and apply any recommended temporary mitigations from Adobe.