CVE-2026-105994
7.7HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-863
Impact
A low-privileged authenticated attacker can bypass security controls and gain unauthorized write access across security scopes. They only need standard network access and a low-privilege account.
Root cause
Incorrect authorization checks fail to restrict low-privileged user actions, leading to a security feature bypass.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Fix & remediation
Consult Adobe Security Bulletin apsb26-144 to identify and apply the specified patch; restrict access to ColdFusion administrative and authenticated endpoints until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.