Adobe ColdFusion CVE-2026-106089

Exploitation requires the attacker to already possess a low-privileged authenticated account on an affected ColdFusion instance (PR:L), and per the vendor CVSS the attack vector is LOCAL (AV:L), meaning a pre-existing foothold or local/session access to the server is needed rather than purely remote reach. No user interaction is required (UI:N) and attack complexity is low (AC:L). Affected deployments are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; instances patched beyond these versions are not vulnerable. The authenticated + local prerequisites are the key limiting factors that reduce realistic risk below a pre-auth network RCE, though the incorrect authorization (CWE-863) means the privilege barrier itself is what is being bypassed.

This is a genuinely serious flaw but with an important caveat that tempers raw-score panic. The vendor (Adobe PSIRT) CVSS:3.1 vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (8.8 High), which models LOCAL attack vector, LOW complexity, LOW privileges required, no user interaction, a changed scope, and total C/I/A impact - i.e. an already-authenticated low-privilege user escalating into arbitrary code execution. Notably, the attack vector is LOCAL (AV:L), not network, yet the tags label this 'Authentication Bypass, RCE' and ColdFusion is a network-facing application server - this is a conflict worth flagging: AV:L implies the attacker already needs a foothold/session or local access, which substantially narrows real-world exposure compared with a pre-auth network RCE. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. SSVC-style reasoning: technical impact is total, but exploitation is 'none observed' and automatability is unlikely given the authenticated local prerequisite. Bottom line: a real priority for ColdFusion operators to patch (incorrect-authorization RCE with scope change is dangerous, and ColdFusion is a historically heavily-targeted product), but the LOCAL/PR:L prerequisites make this an escalation/post-compromise risk rather than an internet-wide mass-exploitation threat - unless the AV:L labeling is itself an error, which should be verified with Adobe advisory APSB26-144.

An attacker who already holds a low-privileged authenticated account on an affected ColdFusion 2023 or 2025 server abuses the incorrect-authorization flaw (CWE-863) to perform an action they should not be allowed to, achieving arbitrary code execution in the context of the running user without any user interaction. Because scope is changed, the resulting code execution can affect resources beyond the originally authorized component. No public exploit code was identified in the provided data, so exploitation would currently require independent research or reverse-engineering of the patch.