Loading vulnerability…
Local Arbitrary Code Execution via Incorrect Authorization in Adobe ColdFusion
CVE-2026-106615 is an incorrect authorization vulnerability in Adobe ColdFusion 2023 before Update 26 and ColdFusion 2025 before Update 14, affecting all supported platforms. A local, low-privileged attacker can exploit the flaw to execute arbitrary code in the context of the current user without user interaction. Exploitation changes the security scope. The vulnerability is rated High with a CVSS 3.1 score of 8.8. The affected function and precise authorization failure are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution in the context of the current user, potentially compromising data confidentiality, data integrity, and service availability within that user's accessible resources. Exploitation crosses a security-authority boundary, but execution as an administrator or system account is not established.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is identified. Pending patching, restrict local access to trusted users, review access controls, minimize permissions granted to low-privileged accounts, and monitor for unauthorized code execution. Apply the relevant ColdFusion Lockdown Guide as defense in depth; these measures do not replace the security update.
Patch, then assume compromise.
Apply the security updates in Adobe bulletin APSB26-144: upgrade ColdFusion 2023 to Update 26 (2023.0.26) or ColdFusion 2025 to Update 14 (2025.0.14), or install a later vendor-supported release containing the fix. Follow Adobe's installation requirements for the applicable release branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.