Adobe ColdFusion: Incorrect authorization allows unauthorized file system write
Summary
Adobe ColdFusion contains an Incorrect Authorization flaw (CWE-863) that allows a low-privileged attacker to bypass security measures and gain unauthorized write access to the file system. According to the official CVE record, the scope is changed and confidentiality and integrity are rated high. No user interaction is required, and the CVSS base score is 9.6. Adobe's bulletin lists different impact and vector data for this CVE, so the classification must be verified before the final risk rating.
Affected
- Adobe ColdFusion 2025: version 2025.0.13 and earlier
- Adobe ColdFusion 2023: version 2023.0.25 and earlier
Fixed in
- Adobe ColdFusion 2025: update to 2025.0.14 (Update 14)
- Adobe ColdFusion 2023: update to 2023.0.26 (Update 26)
Workaround
Unknown. No specific workaround for this CVE has been published. Adobe's serial filter documentation covers general hardening against insecure deserialization and does not fix this issue.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- The CISA SSVC assessment lists exploitation as none and automatable as no.
- No public proof-of-concept is known. This has not been verified against exploit databases.
Our recommendation
- Inventory all ColdFusion instances in the 2023 and 2025 branches and check their versions.
- Apply ColdFusion 2025 Update 14 or ColdFusion 2023 Update 26 as a priority, especially on internet-facing servers.
- Restrict administrator and package-management access and review web application behaviour after patching.
- Verify the CVSS vector and CWE against the NVD record and the Adobe bulletin before finalising the risk rating.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-144 www.adobe.com
- Strix: CVE-2026-106620 www.strix.ai
- VulDB: CVE-2026-106620 vuldb.com
- Adobe ColdFusion 2023 Update 26 release notes guides.adobe.com
- Zero Day Initiative: October 2026 security update review www.zerodayinitiative.com
- Blacktree: Adobe October 2026 security fixes blacktree.nl
- Charlie Arehart: ColdFusion updates released October 13, 2026 www.carehart.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:55.
Original description (NVD)
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.