Adobe ColdFusion CVE-2026-106612

Exploitation requires the attacker to already hold a low-privilege position relative to ColdFusion (CVSS PR:L) - for example a valid low-level application/user account or access to a reachable authenticated interface - rather than being fully anonymous. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The flaw is an incorrect authorization check (CWE-863) that lets this low-privileged actor perform actions beyond their authorization level, reaching code execution; the changed scope (S:C) means impact extends beyond the initially vulnerable component. Limiting factors: the PR:L requirement means a prior foothold/credential is needed, and only ColdFusion 2023 (≤2023.0.25) and 2025 (≤2025.0.13) are listed as affected, so patched or other-generation installs are out of scope. The description does not name a specific non-default feature or configuration toggle, so the condition appears to apply to standard deployments of the affected versions.

This is a genuine high priority, not an inflated CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a changed scope and total confidentiality/integrity/availability impact - the archetype of a highly exploitable server-side RCE. CWE-863 (Incorrect Authorization) combined with the vendor's own 'Authentication Bypass, RCE' tags indicates an authorization control that can be subverted to reach code-execution paths. Several key real-world signals are MISSING from the input and must not be fabricated: no EPSS probability is provided, there is no CISA KEV listing, and no public exploit (POC) is referenced - so at time of analysis there is no public exploit identified. Caveats: ColdFusion has a strong historical track record of rapid post-patch weaponization and prior KEV entries, so the absence of KEV/POC data here likely reflects data freshness rather than low intrinsic risk; the PR:L requirement means an attacker needs at least a low-privilege foothold (e.g., a valid low-level account or a reachable low-trust interface), which modestly limits fully unauthenticated mass exploitation. Treat as urgent-patch given the vendor advisory and 9.9 score, while noting exploitation-probability data (EPSS/KEV) is unavailable to confirm active abuse.

An attacker with a low-privileged ColdFusion account (or access to a low-trust endpoint) sends crafted requests that abuse the flawed authorization check to perform actions beyond their privilege level, ultimately executing arbitrary code in the context of the running ColdFusion user. Because the scope is changed and no user interaction is needed, a single authenticated request chain can pivot from limited access to server compromise. No public exploit is identified at time of analysis, but the low attack complexity makes reliable exploitation plausible once details are reverse-engineered from the patch.