Adobe ColdFusion: Incorrect authorization leads to code execution
Summary
Adobe ColdFusion 2023 and 2025 contain an Incorrect Authorization flaw (CWE-863) that can lead to arbitrary code execution in the context of the current user. An attacker with low privileges can exploit it without user interaction, but exploitation depends on conditions outside the attacker's control. The official CVE record describes a local attack vector with high complexity and a changed scope (CVSS 7.8). The vendor bulletin APSB26-144 lists a different category for this CVE ID (SSRF, High, CVSS 7.1), which has not yet been verified with Adobe.
Affected
- Adobe ColdFusion 2025: 0 to 2025.0.13
- Adobe ColdFusion 2023: 0 to 2023.0.25
Fixed in
- Adobe ColdFusion 2025: 2025.0.14
- Adobe ColdFusion 2023: 2023.0.26
Workaround
- Unknown. No patch-independent mitigation has been confirmed.
- Restrict access to the ColdFusion Administrator and do not expose it to the internet.
- Avoid rendering untrusted HTML with external resource URLs via cfdocument until Adobe addresses the outbound network policy gap.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-144.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Tenable: no known exploits available.
- KEV status: not checked.
- Public proof-of-concept code: none found.
Our recommendation
- Update ColdFusion 2025 to 2025.0.14 or ColdFusion 2023 to 2023.0.26 as soon as possible, and apply the update as a whole, since the bulletin contains further critical and high issues.
- Restrict the ColdFusion Administrator and internet exposure.
- Verify the installed version and the security hotfix status on all servers.
- Check with Adobe whether CVE-2026-106614 is classified as Incorrect Authorization or SSRF.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-144 www.adobe.com
- Strix: CVE-2026-106614 www.strix.ai
- Tenable Nessus plugin 366551 www.tenable.com
- Adobe ColdFusion 2023 Release Update 26 guides.adobe.com
- Blacktree: Adobe October 2026 security fixes blacktree.nl
- Foundeo HackMyCF: ColdFusion security issues foundeo.com
- CVE record mirror: CVE-2026-106614 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:07.
Original description (NVD)
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.