Adobe ColdFusion: Incorrect authorization allows arbitrary code execution
Summary
Adobe ColdFusion 2023 and 2025 contain an incorrect authorization flaw (CVE-2026-106612, CVSS 9.9). An attacker with low privileges can execute arbitrary code in the context of the current user, with a changed scope and high impact on confidentiality, integrity and availability. No user interaction is required, but the attacker needs a valid account or another way to obtain low-privileged access.
Affected
- Adobe ColdFusion 2025: 2025.0.13 and earlier
- Adobe ColdFusion 2023: 2023.0.25 and earlier
- Platform: all
Fixed in
- Adobe ColdFusion 2025: update to 2025.0.14 (Update 14)
- Adobe ColdFusion 2023: update to 2023.0.26 (Update 26)
Workaround
Unknown. No CVE-specific workaround is published; apply the update.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-144.
- No public proof of concept found. CISA SSVC assessment: exploitation none, not automatable.
- Tenable lists no known exploits.
Our recommendation
- Patch ColdFusion 2025 to 2025.0.14 and ColdFusion 2023 to 2023.0.26 as soon as possible.
- Inventory all ColdFusion instances, including Windows hosts.
- Restrict administrator and RDS access and review who holds accounts on the server.
- Review logs for unexpected authenticated activity.
- Confirm the patch deadline in the Adobe bulletin, as sources differ on its priority (Adobe rates it Priority 2).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-144 www.adobe.com
- ColdFusion 2023 Release Update 26 guides.adobe.com
- Tenable Nessus plugin 366551 www.tenable.com
- Zero Day Initiative: October 2026 security update review www.zerodayinitiative.com
- Charlie Arehart: ColdFusion updates released Oct 13, 2026 www.carehart.org
- Blacktree: Adobe October 2026 security fixes blacktree.nl
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:22.
Original description (NVD)
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.