CVE-2026-106612

Summary

ColdFusion contains an Incorrect Authorization vulnerability (CWE-863) that allows low-privileged attackers to execute arbitrary code as the current user, potentially leading to full system compromise. This critical flaw enables remote code execution without requiring user interaction.

Exploitability

Exploitation is straightforward for low-privileged attackers with minimal preconditions, as no user interaction is required and the vulnerability affects the application's authorization logic.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the ColdFusion server with the privileges of the current user, potentially leading to complete system takeover or data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the latest ColdFusion security patch or upgrade to version 2023.0.15 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.