CVE-2026-106622

Executive Summary

CVE-2026-106622 is a critical Server-Side Request Forgery (SSRF) vulnerability in Adobe ColdFusion that carries a CVSS 3.1 base score of 10.0 — the maximum possible severity rating. The flaw requires no authentication, no user interaction, and is exploitable over the network, with a Scope-Changed rating indicating that successful exploitation can compromise resources beyond the vulnerable component itself, enabling privilege escalation. Because no patch, workaround, public proof-of-concept, or vendor advisory has been identified at the time of analysis, all internet-exposed ColdFusion deployments should be treated as at-risk and prioritized for perimeter hardening and compensating controls.

Technical Analysis

CVE-2026-106622 is classified under CWE-918 (Server-Side Request Forgery). The NVD description states, in its entirety, that "ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation," that exploitation "does not require user interaction," and that the "Scope is changed."

Vulnerability class. SSRF occurs when an application accepts a user-supplied reference — typically a URL, hostname, path, or resource identifier — and causes the server itself to fetch or connect to that destination without adequately validating or restricting the target. The attacker does not need direct network reachability to the destination; the vulnerable server acts as a proxy under attacker control.

Mechanism (class-level). Because the server initiates the outbound request, the attacker inherits the server's network position, trust relationships, and identity. In the ColdFusion context this manifests as attacker-supplied request parameters reaching a server-side HTTP client, resource loader, or service connector that performs an outbound fetch. The fetched resource is then either returned to the attacker (full-read SSRF) or acted upon without being returned (blind SSRF). Either variant grants the attacker a request-forwarding primitive originating from the ColdFusion host.

Why "Scope is Changed" matters. The CVSS scope change (S:C) is the single most consequential detail in the description. It indicates that a successful attack — in the assessment of the scoring authority — can affect resources outside the security authority of the vulnerable ColdFusion component. In practical terms, the vulnerable application becomes a pivot point: trust relationships, ACL boundaries, and network segmentation that assume "requests originate from the ColdFusion server" are all subverted.

What is not known. The specific vulnerable endpoint, the parameter name carrying the attacker-controlled URI, the affected ColdFusion major/minor versions, and the exact mechanism by which SSRF escalates to privilege escalation are not disclosed in the provided data. No CNA title, vendor advisory, patch diff, or affected-version range was supplied. These gaps are material — the exploitation steps below are therefore described strictly at the vulnerability-class level and are clearly marked as inferred. No implementation detail (function names, CFM templates, API paths) is fabricated.

Exploitation Scenarios

Important: No public PoC, exploit code, or Nuclei template exists for this CVE as of this analysis. The attack chain below is inferred from the SSRF vulnerability class and the NVD description. Specific endpoint names, parameter names, and version strings are deliberately omitted because they are not provided in the source data.

Step 1 — Reconnaissance / target identification. An attacker identifies internet-reachable ColdFusion hosts. Because ColdFusion is a public-facing application server implementation, exposed installations are enumerable via search engines and service-fingerprint scanning (see SHODAN_DORKS). The attacker confirms the target runs ColdFusion and identifies the application surface that issues server-side outbound requests (e.g., components that fetch remote content, integrate with external services, or load resources by URI). No credentials are obtained at this stage — the vulnerability is pre-authentication (PR:N) and needs no user interaction (UI:N).

Step 2 — Triggering the SSRF. The attacker submits a request containing an attacker-controlled destination reference to a ColdFusion component that performs a server-side fetch. Validation is insufficient (the precise nature of the failure is undisclosed), so the ColdFusion server issues an outbound connection to the attacker-chosen destination using its own network identity and privileges.

Step 3 — Request forwarding / probe execution. Having established the forwarding primitive, the attacker directs the server-side request at internal-only or trust-restricted resources: loopback services, link-local/cloud metadata endpoints, internal admin interfaces, or other hosts reachable from the ColdFusion server but not from the internet. If responses are returned (non-blind SSRF), the attacker reads them; if not (blind SSRF), the attacker infers success through timing, out-of-band callbacks to an attacker-controlled listener, or observable state changes.

Step 4 — Privilege escalation and post-exploitation impact. The NVD description explicitly ties this SSRF to privilege escalation with a changed scope. The attacker leverages the trusted position of the ColdFusion server to reach a resource that itself grants elevated access — classically, an internal control plane that returns credentials or tokens, or an internal service whose trust model assumes requests from the ColdFusion host are authorized. With CVSS confidentiality, integrity, and availability all rated High, the modeled impact includes full read of sensitive data, modification of protected resources, and disruption of service availability. Because scope is changed, the blast radius is not confined to the ColdFusion instance.

Impact Assessment

CVSS 3.1: 10.0 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Business impact. A 10.0 unauthenticated, network-reachable SSRF with scope change is a top-tier risk for any organization running ColdFusion in a DMZ or behind a reverse proxy. Because ColdFusion servers are frequently deployed with broad outbound network access and proximity to internal data stores and management planes, a single vulnerable host can serve as a pivot into the internal environment. The pre-authentication and no-interaction rating means exploitation can be fully automated and conducted at scale; mature adversaries and botnets alike treat such endpoints as commodity targets.

Blast radius. The immediate victim is the ColdFusion instance. The realistic blast radius extends to: (1) any internal service or API reachable from the ColdFusion host, (2) cloud instance metadata / credential endpoints if the host is cloud-hosted, (3) administrative interfaces whose access control is predicated on network position or source-IP trust, and (4) downstream systems those services control. The "privilege escalation" statement in the description means the attacker is not merely reading data — they are expected to acquire elevated access. There is no evidence of active in-the-wild exploitation (not in CISA KEV), but the absence of a patch and the score profile make proactive defense mandatory.

Detection Guidance

Detection for this CVE must be behavioral, because no atomic indicator (file hash, malicious domain) is available. The detection theme across all rule types below is attacker-influenced server-side outbound requests and internal pivot activity.

Sigma Rule

title: ColdFusion Server-Side Request Forgery (CVE-2026-106622) - Outbound Request Anomaly
id: 9c8b7a6d-5e4f-4d3c-9b2a-1f0e9d8c7b6a
status: experimental
description: Detects anomalous server-side outbound network connections from a ColdFusion process consistent with SSRF exploitation (CWE-918 / CVE-2026-106622).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106622
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-106622
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\coldfusion.exe'
      - '\jrun.exe'
      - '\java.exe'
  selection_internal_ports:
    DestinationPort:
      - 22
      - 445
      - 3389
      - 5985
      - 5986
      - 8080
      - 8443
  # Obfuscation techniques: cloud metadata endpoints as destination IP literal
  selection_metadata:
    DestinationIp|cidr:
      - '169.254.0.0/16'
      - '127.0.0.0/8'
  condition: selection_process and (selection_internal_ports or selection_metadata)
falsepositives:
  - Legitimate ColdFusion integrations that connect to internal systems or loopback services.
level: high

YARA Rule

rule CVE_2026_106622_ColdFusion_SSRF_Exploit_Artifacts
{
    meta:
        description = "Detects exploit artifacts and SSRF payload patterns associated with CVE-2026-106622 (ColdFusion SSRF / privilege escalation)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106622"
        date = "2026-01-01"
        cve = "CVE-2026-106622"

    strings:
        $s1 = "CVE-2026-106622" ascii nocase
        $s2 = "169.254.169.254" ascii nocase
        $s3 = "metadata.google.internal" ascii nocase
        $s4 = "ssrf" ascii nocase
        $s5 = "http://127.0.0.1" ascii nocase
        $s6 = "http://localhost" ascii nocase
        $s7 = "coldfusion" ascii nocase

    condition:
        uint16(0) == 0x4D5A or uint32(0) == 0x504B0304 or filesize < 10MB
        and 2 of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106622 ColdFusion SSRF - Internal/Cloud Metadata Fetch Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(http|https|ftp|gopher|file):\/\/(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/Ri"; http.header; content:"Host"; nocase; reference:cve,CVE-2026-106622; classtype:attempted-recon; sid:2026106622; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Note: this rule targets the most common SSRF signature — an attacker embedding an internal or cloud-metadata URL inside a request destined for the ColdFusion server. Tune the private-range patterns to your environment.

Elastic Detection

sequence by host.name with maxspan=10s
  [ network where process.name in ("coldfusion.exe", "jrun.exe", "java.exe")
      and destination.ip in ("169.254.169.254", "127.0.0.1") ]
  [ network where process.name in ("coldfusion.exe", "jrun.exe", "java.exe")
      and destination.port in (22, 445, 3389, 5985, 5986)
      and destination.ip != null ]

The sequence captures the SSRF probe followed immediately by an internal pivot attempt from the same ColdFusion host — a higher-fidelity pattern than either event alone.

Splunk SPL Query

index=network OR index=proxy
| eval is_cf = if(match(lower(src_process), "(?i)coldfusion|jrun"), 1, 0)
| eval is_internal_dest = if(cidrmatch("169.254.0.0/16", dest_ip) OR cidrmatch("127.0.0.0/8", dest_ip) OR dest_port IN (22,445,3389,5985,5986), 1, 0)
| where is_cf=1 AND is_internal_dest=1
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_ip) as destinations values(dest_port) as ports by src_ip, src_process
| where count > 3
| sort - count
| `comment("CVE-2026-106622 ColdFusion SSRF - anomalous server-side outbound connections")`

Wazuh OSSEC Rule

<group name="coldfusion,ssrf,cve-2026-106622,">
  <rule id="1066220" level="12" frequency="3" timeframe="120">
    <if_matched_sid>1066221</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-106622: Repeated ColdFusion server-side outbound connection attempts to internal/metadata addresses (SSRF exploitation)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,ssrf,</group>
  </rule>

  <rule id="1066221" level="6">
    <decoded_as>json</decoded_as>
    <field name="process.name">coldfusion\.exe|jrun\.exe</field>
    <field name="destination.ip">169\.254\.169\.254|127\.0\.0\.1</field>
    <description>CVE-2026-106622: ColdFusion process contacted internal/metadata address (possible SSRF)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, upstream patch, package advisory (OSV), or workaround is available from any tracked source. No affected-version range has been published. Treat this as zero-day-level exposure.

1) Immediate mitigations (deploy now, before a patch exists):

• Remove internet exposure. Place all ColdFusion administrative and application interfaces behind an authenticating reverse proxy, VPN, or zero-trust access gateway. Restrict access to known-good source IP ranges. This alone neutralizes the remote, unauthenticated attack vector.
• Egress filtering and network segmentation. Enforce default-deny outbound policy from the ColdFusion host. Explicitly deny egress to loopback, RFC1918 ranges, link-local 169.254.0.0/16 (cloud metadata), and internal management networks. This is the single highest-value control against SSRF and directly breaks the "scope change"/pivot chain.
• Cloud metadata hardening. Where ColdFusion runs in cloud infrastructure, enforce IMDSv2 (or the equivalent) and restrict instance role permissions so a metadata-fetch SSRF yields no usable credentials.
• Web application firewall. Deploy WAF rules that block requests containing internal/loopback/metadata URL patterns in parameters and reject requests that cause unexpected server-side redirects or fetches.
• Least privilege for the service account. Strip the ColdFusion service account of unnecessary internal network access and system privileges to constrain any privilege escalation that does occur.
• Increase logging and monitoring. Enable verbose outbound-connection logging and deploy the detection rules in the previous section.

2) Patch / upgrade steps (when a fix becomes available):

• Monitor the Adobe ColdFusion security bulletin feed and the NVD entry for CVE-2026-106622 for a fixed release and affected-version range.
• Because no affected versions are published, assume all supported ColdFusion versions are at risk. Plan a maintenance window to upgrade to the first vendor-designated fixed build the moment it ships.
• Do not treat the absence of a listed affected-version range as assurance of safety for any version.

3) Long-term hardening:

• Adopt an allow-list model for all server-side outbound requests in application code — never accept raw user-supplied URIs. Validate scheme, host, and resolved IP after DNS resolution (guard against DNS rebinding).
• Maintain an asset inventory of all ColdFusion deployments, versions, and exposure status; enroll them in a vulnerability management program with continuous external attack-surface monitoring.
• Apply network micro-segmentation so application servers cannot reach control planes, credential stores, or administrative interfaces.
• Track CISA KEV and vendor advisories for this CVE and re-test immediately upon patch release.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-106622
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Adobe Security Bulletins (ColdFusion): https://helpx.adobe.com/security/products/coldfusion.html
• OWASP SSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

Threat actor / exploit-in-the-wild status: CVE-2026-106622 is not listed in CISA KEV at the time of analysis, and no public proof-of-concept, exploit code, or Nuclei template has been identified. No named threat-actor campaign is associated with this CVE in the available data. The absence of in-the-wild evidence reflects detection limitations and disclosure timing, not proof of a low threat — ColdFusion has historically been a target of active exploitation, and a 10.0 pre-auth SSRF with scope change should be assumed exploitable.