Adobe ColdFusion: Incorrect Authorization enables arbitrary code execution
Summary
Adobe ColdFusion 2025 and 2023 contain an Incorrect Authorization flaw (CWE-863) that can lead to arbitrary code execution in the context of the current user. According to the CVE record, an attacker with low privileges and local access can exploit it without user interaction, and the scope is changed. Adobe's bulletin APSB26-144 describes the issue differently (network-reachable, no user interaction), so the exposure must be verified.
Affected
- Adobe ColdFusion 2025: versions 0 to 2025.0.13
- Adobe ColdFusion 2023: versions 0 to 2023.0.25
- Platform: all
- CVSS 8.8 (v3.1, High) per CVE record: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Vector discrepancy: the Adobe bulletin layout appears to show AV:N and S:U for this CVE; not confirmed.
Fixed in
- Adobe ColdFusion 2025: update to 2025.0.14 or later
- Adobe ColdFusion 2023: update to 2023.0.26 or later
Workaround
No CVE-specific workaround known.
- Restrict access to the ColdFusion administrator and RDS endpoints.
- Limit local and low-privilege account access to the server until patched.
Exploitation
- Adobe is not aware of any exploits in the wild for this update.
- CISA SSVC assessment: exploitation none, not automatable.
- No public proof of concept found; status beyond this is unknown.
- Not verified as listed in CISA KEV.
- The exploited flaw CVE-2026-48282 is a different issue and does not indicate exploitation of this CVE.
Our recommendation
- Inventory all ColdFusion instances and their versions.
- Patch to 2025.0.14 or 2023.0.26 or later and test the applications, as the update changes behaviour.
- Review the Update 26 security changes, such as outbound network policy and update-management role requirements.
- Verify the CVSS vector and priority in the live APSB26-144 bulletin and NVD record.
- Treat the update as urgent, as the release contains several critical flaws.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-144 www.adobe.com
- ColdFusion 2023 Release Update 26 (Adobe Guides) guides.adobe.com
- Strix CVE-2026-106615 www.strix.ai
- Tenable plugin pipeline issue 234037 www.tenable.com
- OffSeq Radar CVE-2026-106615 radar.offseq.com
- BlackTree Adobe October 2026 security fixes blacktree.nl
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:12.
Original description (NVD)
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.