CVE-2026-106620 is a critical (CVSS 9.6) incorrect authorization flaw in Adobe ColdFusion 2025 and 2023 that lets a low-privileged attacker get around security measures and gain unauthorized write access over the network.
What Is It
Adobe's PSIRT describes CVE-2026-106620 as an Incorrect Authorization vulnerability (CWE-863) in ColdFusion that can lead to a security feature bypass. An attacker who already has low-level privileges can use it to get around security controls and gain unauthorized write access. The attacker does not need any user interaction, and the scope is changed. That means the impact can reach beyond the vulnerable component.
NVD published the record on 2026-10-13. Its status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
Adobe scores this flaw 9.6 (CRITICAL) under CVSS 3.1, with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N:
- Network-reachable with low attack complexity
- Requires only low privileges and no user interaction
- Changed scope, with high confidentiality and integrity impact
- No availability impact
Any authenticated low-privilege foothold on an exposed ColdFusion server could be turned into unauthorized write access with serious confidentiality and integrity consequences.
The supplied CISA KEV data contains no entry for this CVE. KEV therefore does not confirm active exploitation at this time.
What's Vulnerable
According to Adobe's affected-product data:
| Product | Affected Versions | First Unaffected Version |
|---|---|---|
| ColdFusion 2025 | 2025.0.13 and earlier | 2025.0.14 |
| ColdFusion 2023 | 2023.0.25 and earlier | 2023.0.26 |
The data provides no specific CPE entries.
Patch Status
Adobe lists fixed versions for both affected release lines:
- ColdFusion 2025: update to 2025.0.14 or later
- ColdFusion 2023: update to 2023.0.26 or later
Adobe security bulletin APSB26-144 covers the fix. Administrators should review it and apply the relevant update. Because this CVE is not in KEV, CISA has issued no required action or due date. Given the critical score and the low exploitation bar, ColdFusion instances should still be prioritized for patching, especially internet-facing ones.
Sources
- Adobe Security Bulletin APSB26-144 (ColdFusion)
- NVD: CVE-2026-106620
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)