Adobe ColdFusion CVE-2026-105994

Requires the attacker to already possess a low-privileged authenticated account on the ColdFusion instance (CVSS PR:L), after which no user interaction is needed and the request is delivered over the network. Affected deployments are ColdFusion 2023 at or below update 2023.0.25 and ColdFusion 2025 at or below update 2025.0.13. The limiting factors are: valid low-privilege credentials must be held, and the ColdFusion application/admin interface must be network-reachable to the attacker. The exact feature or configuration flag that triggers the incorrect authorization is not disclosed in the description - verify the precise affected component against Adobe advisory APSB26-144 before building detections.

This is a moderate-priority issue rather than a drop-everything emergency, but it should not be dismissed. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N, base 7.7) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a changed scope and high integrity impact - meaning an authenticated low-privileged user can cross an authorization boundary to write to resources they should not control. The CWE-863 (Incorrect Authorization) classification and 'unauthorized write access' description are consistent with the vector. However, several real-world risk signals are MISSING from the input: no EPSS probability is provided, there is no CISA KEV listing, and no proof-of-concept is referenced - so exploitation likelihood cannot be quantified from the data. The absence of confidentiality and availability impact (C:N/A:N) narrows this to an integrity/security-feature-bypass problem, which tempers raw-score alarm. ColdFusion is historically a frequent target of real-world attacks, so the PR:L barrier (attacker must already hold a low-privileged account) is the main mitigating factor; environments that expose ColdFusion admin/application accounts broadly should treat this as actionable. Net: a genuine authorization-bypass worth patching promptly, but not evidenced as actively exploited at analysis time.

An attacker who already holds a low-privileged ColdFusion account (or compromised such credentials) sends a crafted request over the network that the server fails to authorize correctly, letting them write to resources outside their intended permission scope. Because the CVSS scope is changed, the unauthorized write can affect components beyond the attacker's original security context. No public exploit code is referenced, and no user interaction is required.