Loading vulnerability…
Incorrect Authorization Leading to Arbitrary Code Execution in Adobe ColdFusion
CVE-2026-106614 is an incorrect authorization vulnerability in Adobe ColdFusion 2023 releases before Update 26 and ColdFusion 2025 releases before Update 14, affecting all platforms. A low-privileged local attacker can exploit the flaw to execute arbitrary code in the context of the current user. Exploitation requires conditions beyond the attacker's control but does not require user interaction. The vulnerability has changed security scope and is rated High with a CVSS v3 score of 7.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution with the current user's privileges. The changed security scope indicates that exploitation can affect resources beyond the vulnerable component's security authority. Execution with administrative or system privileges is not established.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is documented. Adobe recommends applying ColdFusion security configuration settings and following the applicable ColdFusion 2023 or 2025 Lockdown Guide as defense-in-depth measures; these do not replace the security update.
Patch, then assume compromise.
Upgrade Adobe ColdFusion 2023 to Update 26 (2023.0.26), ColdFusion 2025 to Update 14 (2025.0.14), or a later supported release containing the fix. Follow Adobe bulletin APSB26-144 for installation requirements and update instructions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.