Key points
- CVE-2026-106612 carries a CVSS score of 9.9, rated Critical.
- The vulnerability affects Adobe ColdFusion 2023 up to version 2023.0.25.
- Adobe ColdFusion 2025 versions up to 2025.0.13 are also impacted.
Adobe ColdFusion environments face a severe security risk due to an incorrect authorization vulnerability. According to the National Vulnerability Database, this flaw allows attackers to execute arbitrary code within the context of the current user. The issue is classified as Critical with a CVSS score of 9.9, indicating a high potential for significant system compromise.
The vulnerability, identified as CVE-2026-106612, stems from weaknesses categorized under CWE-863. A low-privileged attacker can exploit this issue to run unauthorized commands. Crucially, exploitation does not require any user interaction, making it accessible for remote attacks. The scope of the vulnerability is changed, which typically indicates that the attacker can access data beyond their original permissions.
Authorization Failure Mechanics
The core issue involves incorrect authorization checks within the application. This allows a user with limited privileges to perform actions they should not be able to execute. The resulting arbitrary code execution occurs in the context of the current user, potentially elevating privileges or accessing sensitive data. The lack of required user interaction lowers the barrier for exploitation significantly.
Affected Software Versions
Administrators must verify their installed versions immediately. Adobe ColdFusion 2023 is affected up to version 2023.0.25. Similarly, Adobe ColdFusion 2025 is vulnerable up to version 2025.0.13. Any installation running these specific versions or earlier is exposed to this risk. Organizations should inventory all ColdFusion instances to determine their exposure level.
Next steps
Administrators should prioritize identifying all affected systems in their infrastructure. Reviewing access logs for unusual activity from low-privileged accounts is essential. Isolating vulnerable instances from external networks can mitigate immediate risk. Teams should monitor for any signs of exploitation while awaiting further information from the vendor.
Signals worth monitoring
Teams usually detect this activity by reviewing application logs for unexpected command executions from low-privileged users. Check whether standard authorization checks are failing consistently for specific endpoints. Look for anomalous outbound connections originating from the application server. Verify that no new processes are spawned by the web service account. Monitor for any changes to system files or configurations that do not match scheduled maintenance activities.
What to do and how to stay safe: Adobe ColdFusion
- Audit all Adobe ColdFusion servers to confirm installed versions against the affected list.
- Restrict network access to vulnerable ColdFusion instances to limit exposure.
- Monitor application logs for unauthorized command execution attempts from low-privileged accounts.
- Prepare to isolate affected systems from the network once the vendor provides an update.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-106612?
The CVSS score is 9.9, which is rated as Critical.
Which ColdFusion versions are affected?
Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13.
Does exploiting this vulnerability require user interaction?
No, exploitation of this issue does not require user interaction.
