CVE-2026-105994: adobe coldfusion Incorrect Authorization

Vulnerability summary

CVE-2026-105994 is a high (CVSS 7.7) Incorrect Authorization vulnerability in adobe coldfusion. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 27.7% of scored vulnerabilities.

Timeline

1. 13-10-2026
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.