CVSS 9.9 ColdFusion Flaw Lets Low-Priv Users Run Code Without Interaction

Adobe ColdFusion contains a critical authorization flaw that allows attackers to run arbitrary code on affected servers without needing to trick a user into clicking anything. This vulnerability, tracked as CVE-2026-106612, is rated Critical with a CVSS score of 9.9 by the National Vulnerability Database. The issue stems from incorrect authorization checks within the application server, enabling a low-privileged attacker to execute arbitrary code in the context of the current user. Because the scope of the vulnerability is changed, the impact is considered severe, potentially affecting more data or processes than just the attacker’s own session.

The risk

The core problem is an incorrect authorization vulnerability, classified under CWE-863. This means the software fails to properly verify that a user has the right permissions to perform a specific action. In this case, the failure allows a low-privileged attacker to bypass security controls. The attacker can execute arbitrary code, meaning they can run any command or script they choose on the server. This execution happens in the context of the current user. The National Vulnerability Database notes that the scope is changed, indicating that the vulnerability affects more data or processes than just the attacker’s own session.

Who is exposed

Organizations using Adobe ColdFusion 2023 or 2025 are at risk if they have not updated beyond specific version thresholds. According to the NVD record, Adobe ColdFusion 2023 versions up to and including 2023.0.25 are affected. Similarly, Adobe ColdFusion 2025 versions up to and including 2025.0.13 are vulnerable. Any instance running these versions or earlier is potentially exposed to remote code execution.

The vulnerability can be exploited by a low-privileged attacker, as stated in the source material. This implies that the attacker does not need high-level administrative rights to trigger the flaw, but the source does not specify whether valid credentials are required or if the attack can be launched without any prior authentication.

Cost and compliance

The source material does not provide specific details regarding financial costs, regulatory fines, or compliance implications associated with CVE-2026-106612. There is no mention of data breach statistics, incident response costs, or legal penalties in the provided NVD records. Organizations must rely on their own internal risk assessments and compliance frameworks to determine the impact of this vulnerability on their specific regulatory obligations. The lack of specific cost data in the source means that any financial impact would be speculative and not grounded in the provided facts.

What should you do?

Review your current Adobe ColdFusion installations to determine if they fall within the affected version ranges. If you are running ColdFusion 2023 up to 2023.0.25 or ColdFusion 2025 up to 2025.0.13, prioritize verifying your exposure. Monitor vendor communications for official patches or mitigation guidance, as the NVD record does not confirm the availability of a fix. Until an update is provided, consider restricting network access to these servers to limit the attack surface.

The background in plain language

Authorization checks are the digital equivalent of a bouncer verifying a guest list. They ensure that only people with the right permissions can access specific areas or perform certain actions. When this check fails, as in an "incorrect authorization" flaw, the system mistakenly allows unauthorized users to proceed.

Remote code execution is a severe outcome where an attacker can make the server run their own programs. This is dangerous because it gives the attacker control over the system, allowing them to steal data, install malware, or disrupt services. Low-privilege attacks are particularly risky because they do not require the attacker to have an admin account, making it easier to find and exploit these weaknesses across large networks.

Background: Remote code execution vulnerabilities

Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.

Read the full guide: Remote Code Execution Risks and Protection for Small Businesses

What to do and how to stay safe: Adobe ColdFusion

• Audit your inventory to identify all instances of Adobe ColdFusion 2023 and 2025 currently in use.
• Verify the exact version numbers to see if they are at or below the affected thresholds (2023.0.25 and 2025.0.13).
• Restrict external network access to these servers to reduce the likelihood of remote exploitation.
• Monitor vendor advisories for the release of a patch or official mitigation steps once available.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-106612?

The CVSS score is 9.9, which is rated as Critical.

Which versions of Adobe ColdFusion are affected?

Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13 are affected.

Does exploiting this vulnerability require user interaction?

No, the National Vulnerability Database states that exploitation does not require user interaction.