Organisations at Risk: Critical ColdFusion Flaw Enables Remote Code Execution Without Interaction
A critical authorization flaw in Adobe ColdFusion allows low-privileged attackers to run arbitrary code without user interaction. The NVD record lists affected versions.
Key points
- CVE-2026-106612 affects Adobe ColdFusion 2023 and 2025 versions below specific updates.
- The vulnerability carries a CVSS score of 9.9, rated as critical severity.
- Exploitation requires no user interaction and can be performed by low-privileged attackers.
Adobe ColdFusion 2023 and 2025 are affected by a critical authorization vulnerability that could allow arbitrary code execution. According to the National Vulnerability Database, versions of ColdFusion 2025 up to 2025.0.13 and ColdFusion 2023 up to 2023.0.25 are at risk. The source material does not state whether a fix exists. Managed service providers must verify their inventory immediately, as the flaw enables remote code execution in the context of the current user.
How it unfolded
- The National Vulnerability Database listed CVE-2026-106612 with a CVSS score of 9.9.
- The record identifies the weakness as CWE-863, an incorrect authorization issue.
- The scope of the vulnerability is noted as changed, impacting user context.
Who is affected
Organizations running Adobe ColdFusion 2023 or 2025 are exposed to this flaw. The vulnerability allows a low-privileged attacker to execute arbitrary code. According to the source material, exploitation of this issue does not require user interaction. This means attackers can potentially compromise systems remotely without needing to trick a user into clicking a link or opening a file. The impact is severe because the code runs in the context of the current user, potentially granting significant access.
Our take on the response
The high severity rating reflects the ease of exploitation and the lack of required user interaction. That suggests the potential for rapid, automated scanning and exploitation by threat actors. The absence of confirmed patch information leaves administrators in a difficult position, forcing them to rely on compensating controls. The broad version range affected means many enterprises likely have vulnerable instances in production.
Who needs to act first
Teams should prioritize systems exposed to the internet or untrusted networks. Check whether these instances can be temporarily isolated from external traffic. Verify if application-level firewalls can block unauthorized access attempts. Ensure that logging is enabled to detect suspicious activity. Consider restricting access to administrative functions. Back up configurations before making any changes. Test any mitigations in a non-production environment first. Monitor for any official vendor updates closely.
What to do and how to stay safe: Adobe ColdFusion
- Audit all ColdFusion instances to identify versions 2023.0.25 and earlier and 2025.0.13 and earlier.
- Restrict network access to vulnerable servers using firewalls or security groups.
- Monitor logs for unusual activity or unauthorized access attempts.
- Prepare to apply updates once the vendor provides a confirmed fix.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ColdFusion versions are affected by CVE-2026-106612?
Adobe ColdFusion 2025 up to 2025.0.13 and Adobe ColdFusion 2023 up to 2023.0.25 are affected.
Is there a patch available for this vulnerability?
The source material does not state whether a fix exists.
What is the CVSS score for this flaw?
The National Vulnerability Database lists a CVSS score of 9.9, rated as critical.
