Adobe fixed 31 ColdFusion vulnerabilities on 13 October 2026, but one of them is the flaw attackers are actually trying. Security researchers report that FortiGuard intrusion prevention sensors matched attack attempts against CVE-2026-106616 on every day from 15 October through 1 November, making it the single flaw from that bulletin with observed probing in the wild.

The finding comes from Empirical Security, which tracked the Fortinet telemetry in its November CVE review. Adobe rated the bulletin Priority 2, meaning installation within 30 days, and said it knew of no exploits when the fixes shipped. That 30-day window closes on 12 November.

What the flaw does

CVE-2026-106616 is an XML external entity (XXE) vulnerability in ColdFusion 2025 and ColdFusion 2023, scored 8.6 under CVSS. An attacker can send crafted XML that points the ColdFusion parser at an external document definition hosted on a server the attacker controls, and the server then reads files outside the intended scope.

No login and no user interaction are needed, and the attack works over the network. Adobe describes the impact as arbitrary file system read. The flaw was published on 13 October as part of security bulletin APSB26-144, which listed 32 flaws at release before Adobe withdrew one on 21 October.

The attempts are steady, not a flood

Fortinet wrote intrusion prevention signatures for 19 of the 31 flaws in the bulletin. Only one has fired: signature 62588, written for CVE-2026-106616. It went live on 15 October and recorded between one and nine matches a day through 1 November.

That is low-level, steady probing rather than a mass exploitation campaign. The researchers stress that signature matches show someone trying the flaw, not a successful breach, and that the hits could include people testing their own servers. There is no public exploit code in Metasploit or Exploit-DB, and the flaw is not on the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities list.

Even so, the signal stands out. Ten flaws in the same bulletin were rated Critical, including two scored 10.0, yet none of their signatures recorded a single hit. The 8.6 flaw is the one attackers picked up first.

Why a file read matters on ColdFusion

On a ColdFusion server, reading files is rarely where an attack ends. The files that matter sit in each instance's lib folder: password.properties holds the Administrator password hash, neo-datasource.xml holds stored database passwords, seed.properties holds the encryption key for them, and neo-mail.xml holds mail server credentials.

ColdFusion has a long history as an attack target. At least 16 entries on CISA's exploited-vulnerabilities list name the product, the latest a path traversal flaw added on 7 July 2026. A file-read flaw in 2010 was used to steal the Administrator password hash in the same way.

Patch now: the 30-day clock ends 12 November

The fix is ColdFusion 2025 Update 14 or ColdFusion 2023 Update 26, applied to every instance, not only the main one. Affected versions are ColdFusion 2025 Update 13 and earlier, and ColdFusion 2023 Update 25 and earlier. Administrators can confirm the update level on the System Information page in the ColdFusion Administrator.

ColdFusion 2021 gets no fix at all. Its core support ended on 10 November 2025, and its extended support, which does not include security patches, ends on 10 November 2026. Sites still running it should log a risk exception and plan a migration.

If you cannot patch today

Adobe lists no workaround, so the priority is getting the update installed. Until then, teams should block outbound connections from ColdFusion servers except to destinations they need, such as databases, mail relays and update servers, because the attack method depends on the server reaching out to the attacker's host.

The ColdFusion Administrator console should stay off the internet, as Adobe's Lockdown Guide describes. On FortiGate firewalls, signature 62588 ships with a default action of pass, so it must be set to block, and the policy must inspect decrypted traffic for these servers.

Teams should also search ColdFusion logs since 13 October for XML parse errors and failed outbound connections to unfamiliar hosts, and check firewall, proxy and DNS logs for outbound traffic from ColdFusion servers to addresses they do not recognise. If any of it appears, patch first, then rotate the Administrator password and every stored database and mail password.