Act nowDisclosed

Advisory · CVE-2026-106620

Authorization flaw in ColdFusion can bypass a security feature

ColdFusion has an incorrect authorization vulnerability a low-privileged attacker can use to bypass a security feature, with high confidentiality and integrity impact. Adobe rates it CVSS 3.1 9.6.

Advisory published October 13, 2026Independent summary
Vendor
Adobe
Product
ColdFusion
Identifier / CWE
CVE-2026-106620
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

A check that was supposed to keep smaller accounts out of sensitive places simply waves them through.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Low-privilege access

    An attacker with a low-privilege ColdFusion account reaches the protected function.

  2. 02Authorization misjudged

    ColdFusion permits an action the security feature should have blocked.

  3. 03Feature bypassed

    The attacker gains access or capability beyond their role.

What happened

Adobe disclosed CVE-2026-106620 in bulletin APSB26-144: an incorrect authorization vulnerability (CWE-863) in ColdFusion that could result in a security feature bypass for a low-privileged attacker.

Adobe lists the affected ColdFusion releases in APSB26-144 (the NVD record names the 2023 update line through 2023.0.25, with 2023.0.26 listed as unaffected). Apply the update Adobe provides for your release line.

What to do

  1. Inventory every ColdFusion deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to ColdFusion while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for sensitive functions invoked by low-privilege accounts and gaps between expected and actual access in audit logs.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

A bypass score of 9.6 means the control it defeats matters. Update and verify your access model afterwards, not just the version number.