CVE-2026-105898: Incorrect Authorization (CWE-863) in Adobe ColdFusion 2025

CVE-2026-105898 is an Incorrect Authorization vulnerability in Adobe ColdFusion 2025 that enables arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this vulnerability by convincing a victim to open a malicious file, which changes the security scope and allows execution of arbitrary code. The vulnerability affects ColdFusion versions up to 2025.0.13 and 2023.0.25. The CVSS 3.1 vector indicates local attack vector with low attack complexity, requiring low privileges and user interaction, with high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to execute arbitrary code as the current user, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The requirement for user interaction limits the attack vector to scenarios where a user opens a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should exercise caution when opening files from untrusted sources to mitigate exploitation risk.