CVE-2026-106622

Summary

ColdFusion suffers from a Server-Side Request Forgery (SSRF) vulnerability that allows remote attackers to make server-side requests to internal resources, potentially leading to privilege escalation and unauthorized access to backend systems. This critical flaw can be exploited without user interaction, making it particularly dangerous.

Exploitability

The vulnerability is highly exploitable with no user interaction required, allowing attackers to perform SSRF attacks against internal services by crafting malicious requests that bypass normal access controls.

Blast radius

If exploited, this vulnerability could enable attackers to access internal network resources, databases, and backend services that are typically not directly exposed to the internet, potentially leading to full system compromise and data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version is published in the description, so implement network segmentation to restrict access to ColdFusion endpoints and disable unnecessary features that could be exploited for SSRF.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.