Adobe ColdFusion CVE-2026-106617

Exploitation requires the attacker to already possess low-privilege authenticated access to the ColdFusion server (PR:L) and local access to the system or application context (AV:L), rather than purely remote network reach. The flaw is an incorrect authorization check (CWE-863) allowing that low-priv principal to execute code in another user's context with a scope change (S:C). Limiting factors that reduce real-world risk: valid low-privilege credentials or an existing session are mandatory, and the local attack vector means an external unauthenticated attacker cannot trigger it without first gaining a foothold. Affected deployments are specifically ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13); patched/newer builds and ColdFusion 2021 or earlier are out of the stated affected range. No special non-default feature is named in the description, so the condition is primarily possession of a low-privilege account on an unpatched instance.

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) is internally consistent and describes a low-privileged, locally-accessible authorization flaw (CWE-863) that yields full confidentiality/integrity/availability impact with a changed scope - i.e., code execution that breaks out of the attacker's original authorization context. The headline score is HIGH, but the AV:L (local) metric is the key tempering signal: the attacker must already have some foothold or local/authenticated access to the ColdFusion host rather than exploiting it purely over the network, and PR:L means valid low-privilege credentials or an existing session are required. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public POC is referenced, so there is currently no public exploit identified at time of analysis and no evidence of active exploitation. This should be treated as a genuine high priority for ColdFusion operators because of the RCE outcome and because ColdFusion is a historically heavily-targeted product, but it is not a drop-everything network-wormable issue - the local vector and privilege requirement meaningfully narrow realistic exploitation. Note a mild tension worth verifying: the input Tags include 'Authentication Bypass' while the CWE is CWE-863 (Incorrect Authorization) and the vector requires PR:L - this is an authorization (privilege-escalation) bypass by an already-authenticated low-priv user, not an unauthenticated authentication bypass; treat the 'Authentication Bypass' label with caution.

A low-privileged but authenticated user of a ColdFusion 2023 or 2025 instance abuses an incorrect authorization check to perform an action they should not be permitted to, causing arbitrary code to execute in the context of a more privileged user with a changed scope. Because no user interaction is required (UI:N) and complexity is low (AC:L), a single crafted request from the attacker's existing session is sufficient. No public exploit code is currently identified, so exploitation would require the attacker to independently develop the technique.