Advisory · CVE-2026-106612
Authorization flaw in ColdFusion escalates a low-privilege account to code execution
ColdFusion has an incorrect authorization vulnerability a low-privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.9.
- Vendor
- Adobe
- Product
- ColdFusion
- Identifier / CWE
- CVE-2026-106612
CWE-863 - Action timing
- Immediate
Explain it like I’m five
ColdFusion asks the wrong question about who is allowed, gets the wrong answer, and a small account ends up running code.
- 01Reach ColdFusion
An attacker sends requests to a ColdFusion server.
- 02Flaw engaged
The vulnerable function processes the attacker's input without the control it needed.
- 03Code executes
Arbitrary code runs in the context of the ColdFusion service user.
What happened
Adobe disclosed CVE-2026-106612 in bulletin APSB26-144: an incorrect authorization vulnerability (CWE-863) in ColdFusion that could result in arbitrary code execution for a low-privileged attacker.
Adobe lists the affected ColdFusion releases in APSB26-144 (the NVD record names the 2023 update line through 2023.0.25, with 2023.0.26 listed as unaffected). Apply the update Adobe provides for your release line.
What to do
- Inventory every ColdFusion deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to ColdFusion while remediation is underway, especially for internet-facing instances.
- Review application and server logs for low-privilege accounts reaching administrative functions and configuration changes outside their role.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Patch APSB26-144 as one ColdFusion change and audit the account list while the servers are in maintenance anyway.