Key points
- CVE-2026-106612 carries a CVSS score of 9.9, indicating a critical severity level for this authorization flaw.
- The vulnerability affects Adobe ColdFusion 2025 versions up to 2025.0.13 and 2023 versions up to 2023.0.25.
- Exploitation requires no user interaction, allowing attackers to execute arbitrary code in the context of the current user.
Adobe ColdFusion 2023 and 2025 are affected by a critical authorization vulnerability identified as CVE-2026-106612. The flaw allows low-privileged attackers to execute arbitrary code without requiring any user interaction. According to the National Vulnerability Database, the issue stems from incorrect authorization checks within the application. This vulnerability is rated critical with a CVSS score of 9.9. The affected versions include Adobe ColdFusion 2025 up to 2025.0.13 and Adobe ColdFusion 2023 up to 2023.0.25.
In plain English
This vulnerability means that the application fails to properly verify if a user has permission to perform certain actions. An attacker with a low-privilege account can exploit this mistake to run any code they choose on the server. The code runs in the context of the current user, potentially granting access to sensitive data or system functions. The attack does not require a user to click a link or open a file. The attacker can trigger the exploit remotely, making it particularly dangerous for internet-facing systems.
The background
The weakness is classified under CWE-863, which refers to incorrect authorization. This type of flaw occurs when a system grants access to resources or functions without properly checking the user's rights. In this case, the scope of the vulnerability is changed, meaning it can affect more than just the attacker's own data. The National Vulnerability Database lists the issue as allowing arbitrary code execution. This is a severe outcome because it can lead to full system compromise. The flaw impacts multiple versions of the ColdFusion platform released in recent years.
What changes now
Security teams must treat this vulnerability as a high priority due to its critical rating and ease of exploitation. The lack of user interaction requirement means automated attacks are possible. Organizations running the affected versions should immediately assess their exposure. As Vuln Post reported on 2026-10-13, Adobe ColdFusion has faced urgent patching needs for other critical flaws recently. This new CVE adds to the pressure on administrators to maintain strict update cycles. Monitoring for exploitation attempts is essential.
Who needs to act first
Teams usually prioritize systems that are directly exposed to the internet or untrusted networks. Check whether your ColdFusion instances are accessible without additional network segmentation. If the application is internet-facing, reduce exposure by implementing strict access controls or web application firewalls. Back up your configurations before making any changes to your environment. Test any potential mitigations in a non-production environment first to ensure they do not break existing functionality. Isolate affected servers if possible to limit the blast radius of a potential breach.
Background: Blast radius
Blast radius defines the scope of damage when a security control fails. You reduce it by enforcing least privilege, segmenting networks, and verifying code integrity. Isolating components ensures a single compromise does not cascade into a total system failure or data loss event.
Read the full guide: Blast Radius: 8 Questions on Containing Cyber Attack Spread
What to do and how to stay safe: Adobe ColdFusion
- Inventory all systems running Adobe ColdFusion 2023 or 2025 to identify those with versions up to 2023.0.25 and 2025.0.13.
- Restrict network access to ColdFusion servers by blocking unnecessary ports and limiting IP ranges that can reach the application.
- Monitor server logs for unusual activity, such as unexpected code execution or attempts by low-privileged users to access restricted functions.
- Prepare to apply updates immediately once the vendor provides a confirmed fix for CVE-2026-106612.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of Adobe ColdFusion are affected by CVE-2026-106612?
Adobe ColdFusion 2025 up to version 2025.0.13 and Adobe ColdFusion 2023 up to version 2023.0.25 are affected.
Does exploiting this vulnerability require user interaction?
No, exploitation of this issue does not require user interaction, allowing remote attackers to execute code.
What is the severity rating for CVE-2026-106612?
The vulnerability has a CVSS score of 9.9, which is rated as critical.
