Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-106620: Adobe ColdFusion 2025/2023 allows unauthorized write access
CVE-2026-106620 · published today
Summary
The 2025 and 2023 versions of Adobe ColdFusion can be tricked into letting a low‑level user write data without permission. This can happen without any user clicking anything, potentially letting an attacker change or add information on your site. Install the latest security update from Adobe as soon as possible and verify that only trusted users have write rights.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| adobe | coldfusion 2025 | <= 2025.0.13 |
| adobe | coldfusion 2023 | <= 2023.0.25 |
Original advisory text
ColdFusion | Incorrect Authorization (CWE-863)
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-863Incorrect Authorization
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta