Adobe ColdFusion CVE-2026-105901

Exploitation requires an existing low-privileged authenticated session or local access to the ColdFusion server (CVSS PR:L and AV:L) - it is NOT remote-unauthenticated despite the 'Authentication Bypass' tag. The affected software is Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13); systems patched to versions above these per APSB26-144 are not vulnerable. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once the low-privilege foothold exists there are no further special prerequisites. The primary limiting factors for defenders are the requirement for prior low-privileged authentication/local access and the vendor-stated local attack vector, which together constrain this to attackers who already have some access rather than anonymous internet attackers.

This is a genuine high-priority vulnerability but with an important nuance that tempers raw-severity-driven panic. The CVSS 3.1 base score of 8.8 is driven largely by the changed scope (S:C) and the triple high impact (C:H/I:H/A:H) combined with low attack complexity and no user interaction. Critically, however, the vendor-supplied vector specifies AV:L (local attack vector), not network - meaning the attacker must already have local/console or an authenticated application-level foothold (PR:L) rather than reaching the flaw directly from the internet. This is a meaningful discrepancy worth flagging: ColdFusion flaws are frequently remotely exploitable, and the tag 'Authentication Bypass' plus a CWE-863 Incorrect Authorization classification superficially suggest a pre-auth remote issue, yet the CVSS vector explicitly requires low privileges and a local vector - VERIFY the true reachability with Adobe advisory APSB26-144 before deprioritizing or over-prioritizing. On exploitation signals: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so this is no public exploit identified at time of analysis - it is a vendor-disclosed (Adobe PSIRT) issue, not a confirmed in-the-wild threat. Net assessment: patch promptly because ColdFusion is a historically heavily-targeted platform and the impact is code execution with scope change, but the local-vector/low-privilege prerequisite makes mass, unauthenticated internet-wide exploitation unlikely based on the provided vector - this reads as a privilege-escalation-to-RCE issue for an attacker with an existing authenticated foothold rather than a drive-by internet worm.

An attacker who already holds a low-privileged authenticated account on the ColdFusion server (or local access) abuses the incorrect authorization check to perform an action they should not be allowed to, escalating into arbitrary code execution in the context of the current user with a scope change beyond the vulnerable component. No user interaction is required, and because attack complexity is low, a reliable exploit is straightforward once the low-privilege foothold exists. No public exploit is identified at time of analysis, so weaponization would require independent development against the authorization logic.