CVE-2026-106089: Incorrect Authorization (CWE-863) in Adobe ColdFusion 2025

CVE-2026-106089 is an Incorrect Authorization vulnerability in Adobe ColdFusion 2025 that permits a low-privileged attacker to execute arbitrary code in the context of the current user. The vulnerability does not require user interaction and results in a changed security scope, potentially allowing full system compromise. The affected versions include all releases up to and including 2025.0.13 and 2023.0.25. The CVSS 3.1 base score is 8.8, indicating high severity with attack vector local, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to execute arbitrary code, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The scope change indicates that the vulnerability can escalate privileges or bypass existing authorization controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Adobe's official security advisories for updates and apply patches once available.