CVE-2026-105897: ColdFusion SSRF Vulnerability

CVE-2026-105897 Overview

Adobe ColdFusion contains a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] that enables privilege escalation. An unauthenticated remote attacker can exploit this flaw over the network without user interaction. The scope is changed, meaning successful exploitation impacts resources beyond the vulnerable component itself. Adobe published the issue in security advisory APSB26-144.

Critical Impact
An unauthenticated attacker can coerce the ColdFusion server into issuing arbitrary HTTP requests to internal systems, enabling access to protected resources and privilege escalation across trust boundaries.

Affected Products

Adobe ColdFusion (versions listed in advisory APSB26-144)
ColdFusion deployments exposed to untrusted network input
Any application stack relying on the ColdFusion HTTP client for outbound requests

Discovery Timeline

2026-10-13 - CVE CVE-2026-105897 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-105897

Vulnerability Analysis

The vulnerability allows an attacker to manipulate ColdFusion into making server-side HTTP requests to attacker-controlled destinations. Because the request originates from the ColdFusion server, it inherits the server's network position and trust relationships. The changed scope indicates the impact crosses an authorization boundary, allowing the attacker to reach internal services, cloud metadata endpoints, or administrative interfaces that are not reachable from the public internet. The result is unauthorized access leading to privilege escalation. The flaw requires no authentication and no user interaction, lowering the exploitation barrier substantially.

Root Cause

The root cause is improper validation of URLs or hostnames supplied to a ColdFusion component that performs outbound HTTP requests, consistent with [CWE-918]. The affected code path does not restrict request targets to an allowlist, nor does it filter requests to internal address ranges, loopback interfaces, or cloud instance metadata endpoints such as 169.254.169.254. See the Adobe ColdFusion Security Advisory for the authoritative technical description.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to an exposed ColdFusion endpoint that accepts a URL or hostname parameter. ColdFusion processes the request and issues an outbound call to the attacker-specified target. The attacker can target internal administrative APIs, cloud metadata services, or neighboring systems protected by network segmentation, then use returned data or side effects to escalate privileges.

// No verified exploit code is available. Refer to Adobe advisory APSB26-144
// for technical details on affected endpoints and parameters.

Detection Methods for CVE-2026-105897

Indicators of Compromise

Outbound HTTP requests from ColdFusion application servers to internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254
Unexpected entries in ColdFusion application logs showing user-controlled URLs passed to HTTP client functions
Anomalous DNS queries originating from the ColdFusion host for domains unrelated to legitimate application traffic

Detection Strategies

Inspect web server and application logs for request parameters containing URLs, IP literals, or URL-encoded internal addresses
Correlate inbound HTTP requests to ColdFusion with subsequent outbound connections from the same process within a short time window
Deploy network-layer monitoring to flag ColdFusion processes initiating connections to RFC1918 ranges or metadata IPs

Monitoring Recommendations

Enable verbose logging on ColdFusion HTTP client components and forward logs to a centralized analytics platform
Baseline normal outbound destinations for ColdFusion servers and alert on deviations
Monitor egress traffic from application tiers using firewall or cloud flow logs for connections to sensitive internal services

How to Mitigate CVE-2026-105897

Immediate Actions Required

Apply the Adobe security update referenced in advisory APSB26-144 to all ColdFusion instances
Restrict outbound network access from ColdFusion servers using egress firewall rules that deny traffic to internal management ranges and cloud metadata IPs
Audit ColdFusion applications for custom endpoints that accept URLs from user input and add server-side allowlist validation

Patch Information

Adobe has released fixed versions of ColdFusion as detailed in the Adobe ColdFusion Security Advisory APSB26-144. Administrators should consult the advisory for the specific builds that address CVE-2026-105897 and apply them to all production and non-production instances.

Workarounds

Place ColdFusion behind a reverse proxy that strips or validates URL-bearing parameters before forwarding requests
Deploy host-based firewall rules on ColdFusion servers blocking connections to 169.254.169.254 and internal management subnets
Enforce IMDSv2 on AWS instances to require session tokens for metadata access, reducing SSRF impact on cloud workloads

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -m owner --uid-owner coldfusion -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner coldfusion -d 10.0.0.0/8 -p tcp --dport 22 -j DROP