CVE-2026-106617

Summary

Adobe ColdFusion contains an authorization flaw (CWE-863) that allows low-privileged users to execute arbitrary code with the privileges of the current user. This represents a critical escalation from standard user access to system-level execution capability.

Exploitability

Exploitation is relatively straightforward for low-privileged attackers as it requires no user interaction and leverages an incorrect authorization control, making it highly automatable.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the ColdFusion server, potentially leading to complete system compromise, data exfiltration, or further lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ColdFusion 2023.0.15 or later to remediate this authorization flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.