CVE-2026-106614: adobe coldfusion Incorrect Authorization

Vulnerability summary

CVE-2026-106614 is a high (CVSS 7.8) Incorrect Authorization vulnerability in adobe coldfusion. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.5% of scored vulnerabilities.

Timeline

1. 13-10-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.