Patch Forecast
Amber warning
Patch this week.

CVE-2026-106616

Adobe Coldfusion: XML external entity injection

Risk score
66/100
CVSS
8.6 v3.1
Exploit chance (30 days)
0.5%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require u…
Affected
Adobe Coldfusion
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Adobe ColdfusionTHE FLAWSTHE FIXCVE-2026-106616XML external entity injectionCVSS 8.6 · EPSS 1%CVE-2026-106624Code injection can lead toremote code executionCVSS 10.0 · EPSS 1%CVE-2026-106622Server-side request forgerycan lead to privilege escalationCVSS 10.0 · EPSS 1%CVE-2026-105899Unrestricted file upload canlead to remote code executionCVSS 10.0 · EPSS 1%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedAdobe ColdfusionAMBER · PATCH THIS WEEKAdobe ColdfusionColdFusion is affected by anImproper Control of Generationof Code ('Code Injection')vulnerability that could result inarbitrary code execution in thecontext of the current user. Anattacker could exploit this…Where it standsNo known exploitationCONNECTS TOSame weaknessXML external entity injection (CWE-611)28 other warnings in 30 days →Same productEarlier Adobe Coldfusion warnings26 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Adobe Coldfusion: Amber, patch this week. ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Sc…

The flaws

  • CVE-2026-106616: XML external entity injection (CVSS 8.6 · EPSS 1%)
  • CVE-2026-106624: Code injection can lead to remote code execution (CVSS 10.0 · EPSS 1%)
  • CVE-2026-106622: Server-side request forgery can lead to privilege escalation (CVSS 10.0 · EPSS 1%)
  • CVE-2026-105899: Unrestricted file upload can lead to remote code execution (CVSS 10.0 · EPSS 1%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Adobe Coldfusion

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.6 high
  • Remotely exploitable without logging in

References

Original description

ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

Last activity 13 Oct 2026. Patch Forecast updates every hour.