CVE-2026-105994: Incorrect Authorization (CWE-863) in Adobe ColdFusion 2025

CVE-2026-105994 describes an Incorrect Authorization vulnerability in Adobe ColdFusion 2025. This flaw enables an attacker with low privileges to bypass security features and obtain unauthorized write access without requiring user interaction. The vulnerability affects versions up to and including 2025.0.13 and 2023.0.25. The scope of the vulnerability is changed, indicating that the impact extends beyond the initially authorized privileges. The CVSS v3.1 base score is 7.7, reflecting a high severity with network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with low privileges can bypass security mechanisms to gain unauthorized write access, potentially allowing modification of data or configurations. The vulnerability does not impact confidentiality or availability but has a high impact on integrity. Exploitation does not require user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Adobe's advisories for updates. Until a fix is available, restrict access to ColdFusion instances and review permissions to minimize exposure.