CVE-2026-106618
8.8 HIGHPublished 2026-10-13 · Updated 2026-10-15
AI risk analysis
- Summary
- Adobe ColdFusion contains an authorization flaw (CWE-863) that allows low-privileged users to execute arbitrary code as the current user. This represents a critical escalation of privileges vulnerability.
- Exploitability
- Exploitation is straightforward for low-privileged attackers with no user interaction required, making it highly practical to leverage.
- Blast radius
- If exploited, this vulnerability could allow attackers to execute malicious code on affected ColdFusion servers with the privileges of the current user, potentially leading to full system compromise.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to ColdFusion 2023.0.15 or later to remediate this vulnerability.
authorizationprivilege-escalationrcecoldfusion
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-863
Vendors
adobe
Products
coldfusion
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-102862
- HIGHCVE-2026-105901
- HIGHCVE-2026-106089
- HIGHCVE-2026-106090
- CRITICALCVE-2026-106620
- CRITICALCVE-2026-108263PoC
- HIGHCVE-2026-108746PoC
- HIGHCVE-2026-47591PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.