Adobe ColdFusion CVE-2026-106090

Requires an existing low-privileged authenticated account on an affected Adobe ColdFusion instance (2023 up to and including 2023.0.25, or 2025 up to and including 2025.0.13); no user interaction is needed (UI:N). The incorrect authorization check (CWE-863) allows that account to escalate into arbitrary code execution in the current user context, with a changed scope extending impact beyond the vulnerable component. Limiting factors: the attacker must already authenticate at a low privilege level (PR:L), and the provided CVSS vector lists AV:L (local), which - if accurate - would constrain exploitation to local/console-adjacent access rather than fully remote; this limiting factor conflicts with the RCE/Authentication Bypass tags and should be confirmed with Adobe.

This is a high-severity, high-priority flaw that warrants prompt patching but carries notable signal conflicts. The CVSS 3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects an easy-to-exploit, low-privilege path to arbitrary code execution with full confidentiality, integrity and availability impact and a scope change, meaning compromise extends beyond the vulnerable component. However, the vector specifies AV:L (local attack vector), which conflicts with the input Tags 'Authentication Bypass' and 'RCE' that imply a remotely reachable, pre-/low-auth bypass - this discrepancy should be verified against Adobe advisory APSB26-144, as ColdFusion incorrect-authorization RCE issues have historically been network-reachable (AV:N). No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization yet. That said, Adobe ColdFusion has a strong history of post-disclosure exploitation and multiple past KEV entries, so despite the currently low exploitation signals this should be treated as a real priority rather than a high-CVSS-but-low-real-risk issue, especially for internet-exposed instances. Authentication requirement: PR:L in the CVSS vector indicates an authenticated (low-privileged) attacker.

A low-privileged authenticated user of an affected ColdFusion server (2023 ≤2023.0.25 or 2025 ≤2025.0.13) abuses an incorrect authorization check to perform actions beyond their permission level, culminating in arbitrary code execution in the context of the current user without any user interaction. Because scope is changed, the resulting code execution can affect resources beyond the vulnerable module. No public exploit code is identified at time of analysis.