Advisories · Technology

Adobe ColdFusion 2025.

Every CVE that names Adobe ColdFusion 2025 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-105897 CVE record

CVSS 8.6 High

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Server-side request forgery (SSRF)
Not analysed yet 13 Oct 2026
CVE-2026-106616 CVE record

CVSS 8.6 High

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- XML external entities (XXE)
Not analysed yet 13 Oct 2026
CVE-2026-34633 CVE record

CVSS 7.7 High

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Server-side request forgery (SSRF)
Not analysed yet 13 Oct 2026
CVE-2026-106618 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-105994 CVE record

CVSS 7.7 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106622 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Server-side request forgery (SSRF)
Not analysed yet 13 Oct 2026
CVE-2026-106619 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-106089 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106613 CVE record

CVSS 8.8 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-106614 CVE record

CVSS 7.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106624 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Code injection
Not analysed yet 13 Oct 2026
CVE-2026-75996 CVE record

CVSS 7.5 High

ColdFusion | Uncontrolled Resource Consumption (CWE-400)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Denial of service
Not analysed yet 13 Oct 2026
CVE-2026-106621 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Code injection
Not analysed yet 13 Oct 2026
CVE-2026-90530 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Path traversal
Not analysed yet 13 Oct 2026
CVE-2026-105898 CVE record

CVSS 8.2 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-105903 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Code injection
Not analysed yet 13 Oct 2026
CVE-2026-75994 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106090 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-34634 CVE record

CVSS 8.6 High

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Server-side request forgery (SSRF)
Not analysed yet 13 Oct 2026
CVE-2026-106620 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-76001 CVE record

CVSS 7.1 High

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Server-side request forgery (SSRF)
Not analysed yet 13 Oct 2026
CVE-2026-106612 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106615 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-75995 CVE record

CVSS 8.4 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-75748 CVE record

CVSS 7.6 High

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Server-side request forgery (SSRF)
Not analysed yet 13 Oct 2026
CVE-2026-105900 CVE record

CVSS 7.5 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 13 Oct 2026
CVE-2026-105901 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-71385 CVE record

CVSS 8.4 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-106623 CVE record

CVSS 7.5 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-105899 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Unrestricted file upload
Not analysed yet 13 Oct 2026
CVE-2026-106617 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 13 Oct 2026
CVE-2026-76002 CVE record

CVSS 6.1 Medium

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75746 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- SQL injection
Not analysed yet 8 Sept 2026
CVE-2026-76000 CVE record

CVSS 6.5 Medium

ColdFusion | Uncontrolled Resource Consumption (CWE-400)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Denial of service
Not analysed yet 8 Sept 2026
CVE-2026-75998 CVE record

CVSS 7.5 High

ColdFusion | Improper Access Control (CWE-284)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-48273 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Code injection
Not analysed yet 8 Sept 2026
CVE-2026-76190 CVE record

CVSS 8.6 High

ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Code injection
Not analysed yet 8 Sept 2026
CVE-2026-75999 CVE record

CVSS 8.4 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 8 Sept 2026
CVE-2026-75993 CVE record

CVSS 8.5 High

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-83961 CVE record

CVSS 7.1 High

ColdFusion | Improper Authentication (CWE-287)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Authentication bypass
Not analysed yet 3 Sept 2026
CVE-2026-71387 CVE record

CVSS 8.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-48385 CVE record

CVSS 7.7 High

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Command injection
Not analysed yet 11 Aug 2026
CVE-2026-71383 CVE record

CVSS 7.3 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-21279 CVE record

CVSS 8.2 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 11 Aug 2026
CVE-2026-48384 CVE record

CVSS 4.9 Medium

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 11 Aug 2026
CVE-2026-48375 CVE record

CVSS 6.5 Medium

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-21269 CVE record

CVSS 4.6 Medium

ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Cross-site scripting (XSS)
Not analysed yet 11 Aug 2026
CVE-2026-48376 CVE record

CVSS 5.4 Medium

ColdFusion | Improper Encoding or Escaping of Output (CWE-116)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-116
Not analysed yet 11 Aug 2026
CVE-2026-48440 CVE record

CVSS 8.1 High

ColdFusion | Heap-based Buffer Overflow (CWE-122)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Memory corruption
Not analysed yet 11 Aug 2026
CVE-2026-34635 CVE record

CVSS 8.4 High

ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Hard-coded credentials
Not analysed yet 11 Aug 2026
CVE-2026-48386 CVE record

CVSS 7.5 High

ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Weak cryptography or TLS
Not analysed yet 11 Aug 2026
CVE-2026-48362 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Command injection
Not analysed yet 11 Aug 2026
CVE-2026-71386 CVE record

CVSS 8.8 High

ColdFusion | Cross-site Scripting (XSS) (CWE-79)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Cross-site scripting (XSS)
Not analysed yet 11 Aug 2026
CVE-2026-71384 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-25652 CVE record

CVSS 7.8 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 11 Aug 2026
CVE-2026-21273 CVE record

CVSS 8.7 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 11 Aug 2026
CVE-2026-48320 CVE record

CVSS 8.5 High

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Cross-site scripting (XSS)
Not analysed yet 14 Jul 2026
CVE-2026-48324 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- SQL injection
Not analysed yet 14 Jul 2026
CVE-2026-48332 CVE record

CVSS 7.7 High

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Server-side request forgery (SSRF)
Not analysed yet 14 Jul 2026
CVE-2026-48318 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Path traversal
Not analysed yet 14 Jul 2026