On October 13, Adobe fixed 31 ColdFusion vulnerabilities in a single bulletin, APSB26-144. Ten were rated Critical. Adobe said it knew of no exploits for any of them and rated the bulletin Priority 2, which it pairs with installing within 30 days.
FortiGuard wrote IPS signatures for 19 of the 31. Only one has fired: the signature for CVE-2026-106616, an XML external entity (XXE) bug with a CVSS score of 8.6. It went live on October 15 and recorded hits every day from then through November 1.
It was an easy one to miss. October 13 and 14 brought 3,115 new CVE records, 269 of them scored 9.0 or higher, and five of those 269 show any exploitation activity in our data. This one scored too low to make the 269.
What the CVE record says
From the CVE description
ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106616 was published October 13, 2026. It affects ColdFusion 2025 and ColdFusion 2023.
At a glance
Why CVE-2026-106616 matters
The Empirical Foundation model places it in the 99th percentile of all scored CVEs.
FortiGuard IPS signature 62588 matched attack attempts against this CVE on every day from October 15, when the signature shipped, through November 1.
ColdFusion has been around since 1995, and attackers have a long record with it. At least 16 entries on CISA's Known Exploited Vulnerabilities list name it, out of 1,766 as of November 2. The latest, CVE-2026-48282, a path traversal, was added on July 7. Plenty of enterprises still run it, often under an internal or public-facing app nobody has budgeted a rewrite for.
CVE-2026-106616 is reachable over the network, with no login and no user interaction. Adobe says it lets an attacker read files on the server and doesn't name the vulnerable component. FortiGuard's description of signature 62588 gives the method it detects: crafted XML that points the ColdFusion parser at an external DTD on a server the attacker controls.
On a ColdFusion server, reading files is rarely where it ends. The files that matter sit in each instance's lib folder. password.properties holds the Administrator password hash, salted on current versions. neo-datasource.xml holds the database passwords ColdFusion stores, encrypted with a key kept in seed.properties in the same folder, and neo-mail.xml holds the mail server credentials. Reading password.properties was the point of CVE-2010-2861, one of the ColdFusion bugs on the KEV list.
ZDI's October 13 review already called ColdFusion the Adobe patch it would treat as most urgent despite its Priority 2 rating. The telemetry adds which of the 31 bugs someone is actually trying. Here are the five highest-CVSS CVEs in the bulletin, and this one.
| CVE | Adobe's impact | CVSS | FortiGuard signature | Signature hits through November 1 | Foundation percentile |
|---|---|---|---|---|---|
| CVE-2026-105899 | Code execution | 10.0 | Yes | None | 64th |
| CVE-2026-106622 | Privilege escalation | 10.0 | Yes | None | 27th |
| CVE-2026-105903 | Code execution | 9.9 | No | n/a | 49th |
| CVE-2026-106612 | Code execution | 9.9 | No | n/a | 44th |
| CVE-2026-106624 | Code execution | 9.8 | Yes | None | 75th |
| CVE-2026-106616 | File system read | 8.6 | Yes | Every day from October 15 | 99th |
The bulletin listed 32 CVEs at release; Adobe withdrew one on October 21. CVSS scores are as Adobe lists them; Adobe gives CVE-2026-106624 a 9.8, though its vector computes to 10.0. Percentiles are as of November 2. Our score for CVE-2026-106616 comes almost entirely from that same signature telemetry, so the last two columns show one signal twice.
Our Foundation model first scored CVE-2026-106616 on October 13, at the 32nd percentile. The signature started firing on October 15. On October 17 the model had it at the 98th percentile, and it has stayed at the 98th or 99th since. Our history has no stored score between October 13 and 17, so we can't date the jump more precisely than that.
A score that rests on one feed is only as good as that feed's attribution, so we checked the input. Generic XXE signatures post daily counts in the thousands and say nothing about which bug is being tried. These hits all come from signature 62588, Adobe.ColdFusion.CVE-2026-106616.XXE, whose daily count ran between one and nine. FortiGuard's long-running signature for an older ColdFusion XXE, CVE-2016-4264, ran at about twice that over the same weeks (a median daily peak of 9 against 4, higher on 17 of the 18 days), so this reads as steady, low-level activity.
The signal comes from Fortinet's IPS telemetry, one of the exploitation feeds our model reads, and FortiGuard publishes its own counter for it on the signature's public page. It counts attack attempts that match a signature written for this bug. It can't tell an attacker from someone testing their own servers, and it doesn't show whether a target was vulnerable, so it isn't evidence of a breach and doesn't contradict Adobe's statement. What it does show is that someone started trying this bug as soon as there was a signature to catch it.
None of the other signals is wrong here. CVSS describes how bad each bug could be, and the 10.0s are worse bugs. Adobe reports what it knows. KEV waits for reliable evidence of exploitation, and a low daily count of signature matches is not that yet. EPSS estimates the probability of exploitation activity in the next 30 days across all published CVEs, which is a different job from ranking one bulletin.
Bottom line
Patch ColdFusion now. What that changes depends on how your SLA is set:
If it follows Adobe's priority rating, or speeds up only for KEV, APSB26-144 is sitting in a 30-day queue that closes November 12. Pull it forward.
If it follows the highest CVSS in the patch, the update is already on your Critical clock. Put internet-facing ColdFusion first, and hunt as well as patch.
ColdFusion 2021 gets no fix at all; the Mitigation section covers what to do instead.
Mitigation status
Adobe lists no workaround, so the work is getting the update onto every instance and covering the servers it can't reach.
Patch ColdFusion 2025 and 2023 now
Install ColdFusion 2025 Update 14 or ColdFusion 2023 Update 26 on every instance, not only cfusion. Affected: 2025 Update 13 and earlier, 2023 Update 25 and earlier.
Confirm the update level on each instance in the ColdFusion Administrator's System Information page. That works on any operating system.
Tenable plugin 366551 is a credentialed check for Windows hosts, covering 2023 and 2025. Linux instances and ColdFusion 2021 never appear in its results. Tenable's remote plugin 42339 detects ColdFusion on a web server, which helps find instances missing from inventory.
Adobe's bulletin also asks for the latest JDK LTS update, the latest MySQL Java connector, a serial filter review, and the version's Lockdown Guide. Schedule the JDK swap separately so it can't hold up the update. When you do it, re-import any custom CA certificates into the new JDK's truststore and update java.home in each instance's jvm.config.
Treat ColdFusion 2021 as vulnerable
APSB26-144 lists only 2025 and 2023, so it says nothing about 2021. Update 23, released December 9, 2025, was the last 2021 release. Core support ended November 10, 2025, and Adobe's extended support, which ends November 10, 2026, does not include security patches.
Log a risk exception, apply the next section, and migrate.
Cut outbound access on servers you can't patch today
The attempts signature 62588 catches point the parser at a DTD on the attacker's host. Blocking outbound connections from ColdFusion servers, except to destinations they need (databases, mail relays, update servers), breaks that method.
Treat it as a stopgap. It doesn't stop XXE variants that reuse a file already on the server, and DNS lookups can still carry data out unless these servers use resolvers that don't recurse arbitrary external domains.
Keep the ColdFusion Administrator, /CFIDE/administrator, off the internet, as the Lockdown Guide describes.
On FortiGate, signature 62588 covers this CVE, but FortiGuard ships it with a default action of pass, which lets the traffic through. Set it to block, and confirm the policy inspects decrypted traffic for these servers (inbound SSL inspection, or a sensor behind the TLS terminator). A block rule can't act on traffic the sensor can't read.
Check whether a server already reached out
Search each instance's exception.log and coldfusion-error.log since October 13 for XML parse errors and for failed outbound connections (ConnectException, UnknownHostException) naming hosts you don't recognize.
In firewall, proxy, and DNS logs from the same date, look for outbound HTTP, FTP, or DNS from ColdFusion servers to unfamiliar hosts. The attacker's DTD doesn't need a .dtd extension.
If you log request bodies, search for <!DOCTYPE with SYSTEM or PUBLIC pointing at an outside URL.
If you find any of it, patch first, then rotate. Assume the instance's lib folder was read: change the Administrator password and every datasource and mail server password ColdFusion stores, on the database and mail side as well. Then look for Administrator logins from addresses you don't recognize.
References
https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html
https://www.thezdi.com/blog/2026/10/13/the-october-2026-security-update-review
https://coldfusion.adobe.com/2025/04/planning-ahead-coldfusion-2021-support-ending-soon/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Every month we pick one CVE, put the signals side by side (exploitation telemetry, EPSS, KEV, exploit code), and show our work. Our Foundation model had this CVE at the 98th percentile on October 17, two days after the first signature hit, with no public exploit module. See how your portfolio ranks at empiricalsecurity.com.
