CVE-2026-105901

Summary

Adobe ColdFusion contains an authorization flaw (CWE-863) that allows low-privileged users to execute arbitrary code with the privileges of the current user. This represents a critical escalation from standard user access to system-level code execution.

Exploitability

Exploitation is straightforward for low-privileged attackers as it requires no user interaction and can be triggered through the application's API or web interface, making it highly suitable for automated attacks.

Blast radius

If exploited, this vulnerability could allow attackers to execute malicious code on the ColdFusion server with the privileges of the current user, potentially leading to full system compromise or data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ColdFusion 2023.0.15 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.