Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1031
_____________________________________________________________________

DATE                : 15/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Adobe ColdFusion versions prior
                              to 2025.0.14, 2023.0.26.

====================================================================
https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
_____________________________________________________________________


Adobe Security Bulletin
Last updated on Oct 14, 2026
Security update available for Adobe ColdFusion | APSB26-144

Bulletin ID          Date published         Priority
APSB26-144           October 13, 2026       2

Summary
Adobe has released a priority 2 security update for Adobe ColdFusion.
This update addresses vulnerabilities rated critical, high, and medium
that could result in arbitrary code execution, security feature bypass,
arbitrary file system write, privilege escalation, arbitrary file
system read, application denial-of-service, and memory exposure.

Adobe is not aware of any exploits in the wild for any of the issues
addressed in this update.

Affected Versions

Product                   Version              Platform
Adobe ColdFusion 2025     2025.0.13            All
Adobe ColdFusion 2023     2023.0.25            All


Solution
Adobe categorizes this update with the following priority rating
and recommends users update their installation to the newest
version:

Product      Updated version     Platform      Priority rating
Installation instructions

Adobe ColdFusion 2025    2025.0.14   All       2   Release Notes
Adobe ColdFusion 2023    2023.0.26   All       2   Release Notes

Note
For security reasons, we strongly recommend using the latest mysql
java connector. For more information on its usage, please refer
to: https://helpx.adobe.com/coldfusion/kb/coldfusion-configuring-mysql-jdbc.html

See the updated serial filter documentation for more details on
protection against insecure deserialization attacks:
https://helpx.adobe.com/coldfusion/kb/coldfusion-serialfilter-file.html

Vulnerability Details

CVE-2026-105899
Vulnerability category: Unrestricted Upload of File with Dangerous
Type (CWE-434)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106622
Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-105903
Vulnerability category: Improper Control of Generation of Code
('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106612
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106624
Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-75994
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.6
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106620
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary file system write
Severity: Critical
CVSS base score: 9.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CVE-2026-90530
Vulnerability category: Improper Limitation of a Pathname to
a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.3
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106621
Vulnerability category: Improper Control of Generation of
Code ('Code Injection') (CWE-94)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE-2026-106619
Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.0
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-105901
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106089
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106090
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106613
Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-106615
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106617
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-106618
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-34634
Vulnerability category: Server-Side Request Forgery (SSRF)
(CWE-918)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE-2026-105897
Vulnerability category: Server-Side Request Forgery (SSRF)
(CWE-918)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE-2026-106616
Vulnerability category: Improper Restriction of XML External
Entity Reference ('XXE') (CWE-611)
Vulnerability impact: Arbitrary file system read
Severity: High
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE-2026-71385
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.4
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE-2026-75995
Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.4
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE-2026-105898
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CVE-2026-106614
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-34633
Vulnerability category: Server-Side Request Forgery (SSRF)
(CWE-918)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CVE-2026-105994
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Security feature bypass
Severity: High
CVSS base score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

CVE-2026-75748
Vulnerability category: Server-Side Request Forgery (SSRF)
(CWE-918)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 7.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

CVE-2026-75996
Vulnerability category: Uncontrolled Resource Consumption
(CWE-400)
Vulnerability impact: Application denial-of-service
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-105900
Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Application denial-of-service
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-106623
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Memory exposure
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2026-76001
Vulnerability category: Server-Side Request Forgery (SSRF)
(CWE-918)
Vulnerability impact: Privilege escalation
Severity: High
CVSS base score: 7.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

CVE-2026-48378
Vulnerability category: Server-Side Request Forgery (SSRF)
(CWE-918)
Vulnerability impact: Privilege escalation
Severity: Medium
CVSS base score: 5.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Note
Adobe recommends updating your ColdFusion JDK/JRE LTS version
to the latest update release as a secure practice. The
ColdFusion downloads page is regularly updated to include the
latest Java installers for the JDK version your installation
supports as per the matrices below.

ColdFusion 2025 support matrix
ColdFusion 2023 support matrix
For instructions on how to use an external JDK, view Change
ColdFusion JVM.

Adobe also recommends applying the security configuration settings
included in the ColdFusion Security documentation as well as review
the respective Lockdown guides.

ColdFusion 2025 Lockdown Guide
ColdFusion 2023 Lockdown Guide

Acknowledgments
Adobe would like to thank the following researchers for reporting
the relevant issues and for working with Adobe to help protect
our customers:

nbxiglk (nbxiglk) — CVE-2026-71385
AnirudhAnand (a0xnirudh) — CVE-2026-105899, CVE-2026-75994
hritik — CVE-2026-106622
anonymous_blackzero — CVE-2026-105903, CVE-2026-106612,
CVE-2026-106624, CVE-2026-106620, CVE-2026-106619, CVE-2026-106613,
CVE-2026-106615, CVE-2026-106617, CVE-2026-106618, CVE-2026-106616,
CVE-2026-75995, CVE-2026-105898, CVE-2026-106614, CVE-2026-105994
CVD — CVE-2026-90530
elite (e0x1337) — CVE-2026-106621
Sébastien Morin (smsecurity) — CVE-2026-106089
Matan Sandori (matans1) — CVE-2026-106090, CVE-2026-75996,
CVE-2026-106623, CVE-2026-76001
Matan Sandori (matans1) and 2Bsecure — CVE-2026-105901,
CVE-2026-105900
limit3d — CVE-2026-105897
NOTE: Adobe maintains a public bug bounty program through Intigriti.
If you’re an external security researcher interested in identifying
and responsibly reporting potential security vulnerabilities to
Adobe, please visit the Adobe Bug Bounty Program for more
information.

For more information, visit Adobe Security Bulletin and Advisories
or email PSIRT@adobe.com.

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================