Vulnerability in Adobe ColdFusion 2025

[ Description ]Official description

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL16 Oct 2026NCSC-2026-0435

  Vulnerabilities fixed in Adobe ColdFusion Translated from Dutch

  Probability/damage M/HCVE-2026-105897CVE-2026-105898CVE-2026-105899+29 more CVEs
• CERT-FR14 Oct 2026CERTFR-2026-AVI-1301

  Multiple vulnerabilities in Adobe products Translated from French

  Multiple vulnerabilities have been discovered in Adobe products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-71385CVE-2026-92911CVE-2026-95631+41 more CVEs
• BSI CERT-Bund13 Oct 2026WID-SEC-2026-3945

  Adobe ColdFusion: Multiple vulnerabilities Translated from German

  CVE-2026-106618CVE-2026-106623CVE-2026-71385+29 more CVEs

[ References ]References

• www.adobe.com/trust/security/products/coldfusion/apsb26-144.htmlVendor Advisory