Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-106090

Adobe Coldfusion: incorrect authorisation can lead to remote code execution

Risk score
54/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.1%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Affected
Adobe Coldfusion
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Adobe ColdfusionTHE FLAWSTHE FIXCVE-2026-106090Incorrect authorisation canlead to remote code executionCVSS 8.8 · EPSS 0%CVE-2026-106624Code injection can lead toremote code executionCVSS 10.0 · EPSS 1%CVE-2026-106622Server-side request forgerycan lead to privilege escalationCVSS 10.0 · EPSS 1%CVE-2026-105899Unrestricted file upload canlead to remote code executionCVSS 10.0 · EPSS 1%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedAdobe ColdfusionAMBER · PATCH THIS WEEKAdobe ColdfusionColdFusion is affected by anImproper Control of Generationof Code ('Code Injection')vulnerability that could result inarbitrary code execution in thecontext of the current user. Anattacker could exploit this…Where it standsNo known exploitationCONNECTS TOSame weaknessIncorrect authorisation (CWE-863)336 other warnings in 30 days →Same productEarlier Adobe Coldfusion warnings26 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Adobe Coldfusion: Amber, patch this week. ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Sc…

The flaws

  • CVE-2026-106090: Incorrect authorisation can lead to remote code execution (CVSS 8.8 · EPSS 0%)
  • CVE-2026-106624: Code injection can lead to remote code execution (CVSS 10.0 · EPSS 1%)
  • CVE-2026-106622: Server-side request forgery can lead to privilege escalation (CVSS 10.0 · EPSS 1%)
  • CVE-2026-105899: Unrestricted file upload can lead to remote code execution (CVSS 10.0 · EPSS 1%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Adobe Coldfusion

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.8 high

References

Original description

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Last activity 13 Oct 2026. Patch Forecast updates every hour.