CVE-2026-106617: Adobe ColdFusion

High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Affected products

• Adobe ColdFusion: version 2023 only; version 2025 only

Published 2026-10-13. Last modified 2026-10-16.