CVE-2026-106618: Incorrect Authorization (CWE-863) in Adobe ColdFusion 2025

CVE-2026-106618 is an Incorrect Authorization vulnerability in Adobe ColdFusion 2025 that enables a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects versions up to and including 2025.0.13 and 2023.0.25. The vulnerability changes the security scope, increasing the potential impact. The CVSS v3.1 base score is 8.8, indicating a high severity with low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to execute arbitrary code as the current user, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The scope change indicates that the vulnerability may allow privilege escalation or affect resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Adobe's security advisories for updates. Until a fix is available, restrict access to ColdFusion instances and apply principle of least privilege to limit potential exploitation.