Loading vulnerability…
Incorrect Authorization Leading to Arbitrary Code Execution in Adobe ColdFusion
CVE-2026-106090 is an incorrect authorization vulnerability in Adobe ColdFusion 2023 before Update 26 and ColdFusion 2025 before Update 14, affecting all supported platforms. A low-privileged local attacker can exploit the flaw to execute arbitrary code in the context of the current user without user interaction. Exploitation changes the security scope. The vulnerability is rated High with a CVSS 3.1 base score of 8.8. The specific vulnerable function and exploitation mechanism are not disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution in the context of the current user, potentially compromising the confidentiality, integrity, and availability of resources accessible to that execution context. The changed security scope indicates that effects can extend beyond the vulnerable component's security authority; execution as an administrator or system account is not established.
If you can’t patch tonight, do this now.
Restrict access to affected ColdFusion components and enforce least privilege for local users and application execution accounts. Apply Adobe's ColdFusion security configuration guidance and the appropriate Lockdown Guide as defense in depth. No vulnerability-specific temporary workaround is identified; these controls do not replace installing the security update.
Patch, then assume compromise.
Upgrade Adobe ColdFusion 2023 to Update 26 (2023.0.26), or ColdFusion 2025 to Update 14 (2025.0.14), or a later supported release containing the fixes, following Adobe security bulletin APSB26-144 and its installation requirements.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.