CVE-2026-106616

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106616", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-10-07T00:39:38.325Z", "datePublished": "2026-10-13T20:21:44.991Z", "dateUpdated": "2026-10-14T14:53:07.048Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ColdFusion 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2025.0.13", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2025.0.14", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ColdFusion 2023", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2023.0.25", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2023.0.26", "versionType": "custom"}]}], "datePublic": "2026-10-13T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 8.6, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "NETWORK", "modifiedAvailabilityImpact": "NONE", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "CHANGED", "modifiedUserInteraction": "NONE", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "CHANGED", "temporalScore": 8.6, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-10-13T20:21:44.991Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html"}], "source": {"discovery": "EXTERNAL"}, "title": "ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106616", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T14:18:53.320571Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T14:53:07.048Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106616", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-10-07T00:39:38.325Z", "datePublished": "2026-10-13T20:21:44.991Z", "dateUpdated": "2026-10-13T20:21:44.991Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ColdFusion 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2025.0.13", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2025.0.14", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ColdFusion 2023", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2023.0.25", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2023.0.26", "versionType": "custom"}]}], "datePublic": "2026-10-13T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 8.6, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "NETWORK", "modifiedAvailabilityImpact": "NONE", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "CHANGED", "modifiedUserInteraction": "NONE", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "CHANGED", "temporalScore": 8.6, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-10-13T20:21:44.991Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html"}], "source": {"discovery": "EXTERNAL"}, "title": "ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106616", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T14:18:53.320571Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-14T14:45:30.679Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ColdFusion 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2025.0.13", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2025.0.14", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ColdFusion 2023", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2023.0.25", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2023.0.26", "versionType": "custom"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*", "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*", "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*", "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*", "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*", "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*", "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*", "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*", "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*", "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*", "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*", "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*", "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*", "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*", "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*", "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update23:*:*:*:*:*:*", "matchCriteriaId": "13EFA757-3EA9-4910-8B63-B49AAC5FA894", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update24:*:*:*:*:*:*", "matchCriteriaId": "260EA6D6-46E7-4E8B-B421-1D265F5DE8EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update25:*:*:*:*:*:*", "matchCriteriaId": "42528A15-5BAA-48C8-A6CC-1C42C55CE140", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*", "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*", "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*", "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*", "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*", "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*", "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*", "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*", "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*", "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*", "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update12:*:*:*:*:*:*", "matchCriteriaId": "04938F4B-485B-42A5-99FA-9C6B20BED667", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update13:*:*:*:*:*:*", "matchCriteriaId": "61E90277-4821-404E-A806-CE52B2D39C1A", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update14:*:*:*:*:*:*", "matchCriteriaId": "285B4744-992F-405D-9E69-49FED60C4ADF", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*", "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*", "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*", "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*", "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*", "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*", "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*", "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*", "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}], "id": "CVE-2026-106616", "lastModified": "2026-10-16T17:26:40.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106616", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-14T14:18:53.320571Z", "version": "2.0.3"}}]}, "published": "2026-10-13T21:17:30.810", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2023:update1,2023:update25]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2025:update1,2025:update14]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "product": "coldfusion", "vendor": "adobe"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2023.0.25]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2023.0.26"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ColdFusion 2023", "source": "cna", "vendor": "Adobe"}, "product": "coldfusion_2023", "vendor": "adobe"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2025.0.13]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2025.0.14"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ColdFusion 2025", "source": "cna", "vendor": "Adobe"}, "product": "coldfusion_2025", "vendor": "adobe"}], "created": "2026-10-14T19:30:06.303802+00:00", "updated": "2026-10-17T08:45:05.307105+00:00", "vendors": ["adobe", "adobe$PRODUCT$coldfusion", "adobe$PRODUCT$coldfusion_2023", "adobe$PRODUCT$coldfusion_2025"]}