CVE-2026-106612 is a critical (CVSS 9.9) incorrect authorization vulnerability in Adobe ColdFusion 2025 and 2023. Adobe says successful exploitation could let a low-privileged attacker execute arbitrary code without user interaction.
What Is It
CVE-2026-106612 is an Incorrect Authorization vulnerability (CWE-863) in Adobe ColdFusion. Adobe's PSIRT says successful exploitation could lead to arbitrary code execution in the context of the current user. An attacker needs only low privileges, and no user interaction is required.
Adobe assigned the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That breaks down as:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: Low
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, integrity, and availability impact
NVD published the record on 2026-10-13. Its status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
A 9.9 score puts this flaw near the top of the CVSS scale. The attack works over the network, has low complexity, and needs no user interaction. Because the scope is changed, a successful exploit can affect resources beyond the vulnerable ColdFusion component itself. Any authenticated low-privileged account could be enough to reach code execution, which makes exposed ColdFusion servers a high-priority patching target.
This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the supplied data does not confirm active exploitation. Given the severity, defenders should not wait for a KEV listing before acting.
What's Vulnerable
According to Adobe's affected-product data in the NVD record:
| Product | Affected Versions | First Unaffected Version |
|---|---|---|
| ColdFusion 2025 | 2025.0.13 and earlier | 2025.0.14 |
| ColdFusion 2023 | 2023.0.25 and earlier | 2023.0.26 |
The NVD record does not yet list any CPE entries.
Patch Status
Adobe has published security bulletin APSB26-144 for this issue. The affected-version data marks these as the first unaffected releases:
- ColdFusion 2025: Update 14 (2025.0.14)
- ColdFusion 2023: Update 26 (2023.0.26)
Administrators should check the Adobe bulletin and upgrade to these versions or later. Because there is no KEV entry, CISA has not issued a required action or due date for federal agencies.