EXPOSURES › CVE-2026-106621
CVE-2026-106621
CRITICALColdFusion suffers from a critical code injection flaw allowing arbitrary code execution without user interaction.
A code injection vulnerability in ColdFusion enables attackers to execute arbitrary code in the context of the current user without requiring user interaction. DIB organizations must ensure their ColdFusion deployments are patched immediately to prevent remote code execution and potential data breaches. This failure highlights the risk of relying on unpatched software with critical CVEs.
Shame score — A critical code injection flaw allowing arbitrary code execution without user interaction represents a severe, avoidable security failure that could lead to data breaches and system compromise.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.