Adobe ColdFusion 2023, 2025 versions face CVSS 9.6 critical risk from CVE-2026-106620 auth flaw

Adobe ColdFusion contains a critical authorization bypass vulnerability that allows attackers with low privileges to gain unauthorized write access to systems. According to the National Vulnerability Database, this flaw, identified as CVE-2026-106620, carries a CVSS score of 9.6. The issue stems from incorrect authorization logic, classified under CWE-863, which permits security feature bypasses.

What versions are affected by this vulnerability?

The National Vulnerability Database lists specific affected versions for Adobe ColdFusion. The flaw impacts Adobe ColdFusion 2025 up to version 2025.0.13. It also affects Adobe ColdFusion 2023 up to version 2023.0.25. Organizations running these specific builds are exposed to the risk of unauthorized data modification.

How does the exploitation work?

According to the NVD record, exploitation of this issue does not require user interaction. A low-privileged attacker can leverage the incorrect authorization vulnerability to bypass security measures. This allows the attacker to gain unauthorized write access directly. The scope of the vulnerability is noted as changed, indicating a shift in privilege level during exploitation.

What is the severity rating?

The National Vulnerability Database rates CVE-2026-106620 as Critical with a CVSS score of 9.6. This high severity reflects the ease of exploitation and the significant impact of unauthorized write access. The weakness is categorized as CWE-863, which pertains to incorrect authorization.

What is the current remediation status?

The source material provided does not confirm the availability of a patch, fix, or update for CVE-2026-106620. Security teams should monitor official Adobe channels for announcements regarding mitigations. Until a vendor-provided solution is confirmed, organizations must assess their exposure based on the affected versions listed in the NVD record.

Questions to ask your suppliers

Teams usually begin by verifying whether their suppliers are running affected versions of Adobe ColdFusion. Ask if they have isolated these systems from untrusted networks. Determine who inside the organization is responsible for monitoring vendor security advisories. Check whether current access controls can mitigate the risk of unauthorized write access. Ensure that incident response plans account for authorization bypass scenarios. Identify which third-party services depend on this software. Confirm that logging mechanisms are active to detect anomalous write operations. Establish a clear communication channel for urgent security updates from vendors.

What to do and how to stay safe: Adobe ColdFusion

• Audit your environment to identify any instances of Adobe ColdFusion 2023 or 2025 within the affected version ranges.
• Restrict network access to ColdFusion servers to limit exposure from untrusted sources while awaiting vendor guidance.
• Monitor server logs for unauthorized write operations or anomalous activity from low-privileged accounts.
• Prepare an incident response plan that addresses authorization bypass scenarios and data integrity violations.

Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-106620?

The National Vulnerability Database rates CVE-2026-106620 as CVSS 9.6 Critical.

Does exploiting this vulnerability require user interaction?

No, exploitation of this issue does not require user interaction according to the NVD record.

Which Adobe ColdFusion versions are affected?

Adobe ColdFusion 2025 up to 2025.0.13 and Adobe ColdFusion 2023 up to 2023.0.25 are affected.