Key points
- CVE-2026-106612 affects Adobe ColdFusion 2023 up to 2023.0.25 and 2025 up to 2025.0.13.
- The vulnerability is rated Critical with a CVSS score of 9.9.
- Exploitation requires no user interaction, enabling remote arbitrary code execution.
Attackers can execute arbitrary code on affected Adobe ColdFusion servers by exploiting a severe authorization flaw. According to the National Vulnerability Database, this vulnerability, identified as CVE-2026-106612, allows low-privileged attackers to gain significant control over the system. The issue stems from incorrect authorization checks that fail to properly restrict access, leading to arbitrary code execution in the context of the current user.
In plain English
This security flaw means that the software does not correctly verify who is trying to perform actions. An attacker does not need high-level permissions or to trick a user into clicking a link. They can simply send a request to the server, and the system will execute their code. This happens because the application fails to enforce proper boundaries between different user privilege levels, allowing restricted actions to be performed by anyone with network access.
The background
The National Vulnerability Database lists this issue under CWE-863, which relates to incorrect authorization. The vulnerability affects specific versions of Adobe ColdFusion, including the 2023 release up to version 2023.0.25 and the 2025 release up to version 2025.0.13. The CVSS score of 9.9 indicates a Critical severity rating. This high score reflects the ease of exploitation and the severe impact of arbitrary code execution.
What changes now
Organisations using these specific versions of ColdFusion are at immediate risk. The National Vulnerability Database notes that exploitation does not require user interaction, meaning automated attacks are possible. Since the scope of the vulnerability is changed, the impact is significant. Managed service providers must assess their client environments to determine if any instances fall within the affected version ranges.
The attacker's path
Teams usually start by identifying exposed services that accept remote requests. In this scenario, the weakness lies in the application’s failure to validate user privileges before executing commands. This stage of an intrusion serves as initial access, allowing attackers to bypass authentication barriers. Check whether your monitoring tools detect unusual command executions from low-privileged accounts. Focus on network traffic patterns that suggest unauthorised code execution attempts.
What to do and how to stay safe: Adobe ColdFusion
- Inventory all ColdFusion installations to confirm they are not within the affected version ranges.
- Monitor server logs for unexpected code execution or privilege escalation attempts.
- Restrict network access to ColdFusion instances to trusted IPs where possible.
- Prepare to apply vendor updates once a patch for CVE-2026-106612 is released.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ColdFusion versions are affected by CVE-2026-106612?
Adobe ColdFusion 2023 up to 2023.0.25 and Adobe ColdFusion 2025 up to 2025.0.13 are affected.
Is user interaction required to exploit this vulnerability?
No, exploitation of this issue does not require user interaction.
What is the CVSS score for this vulnerability?
The CVSS score is 9.9, which is rated as Critical.
