CVE-2026-105901: ColdFusion Authorization Bypass Vulnerability

CVE-2026-105901 Overview

CVE-2026-105901 is an Incorrect Authorization vulnerability [CWE-863] in Adobe ColdFusion. A low-privileged attacker with local access can exploit the flaw to execute arbitrary code in the context of the current user. Exploitation requires no user interaction, and the scope is changed, meaning the impact extends beyond the vulnerable component's security authority. Adobe published guidance in security bulletin APSB26-144.

Critical Impact
A low-privileged local attacker can bypass authorization checks in ColdFusion and achieve arbitrary code execution with high impact to confidentiality, integrity, and availability.

Affected Products

Adobe ColdFusion (versions listed in Adobe security bulletin APSB26-144)

Discovery Timeline

2026-10-13 - CVE-2026-105901 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-105901

Vulnerability Analysis

The flaw is categorized under [CWE-863]: Incorrect Authorization. ColdFusion performs an authorization check, but the check does not correctly enforce the intended policy. A user who holds only low privileges can therefore reach code paths that should be restricted to higher-privileged roles.

Because scope is changed, the exploited component affects resources beyond its own security boundary. Successful exploitation yields arbitrary code execution in the context of the current user. Confidentiality, integrity, and availability impacts are all rated high, which allows an attacker to read sensitive data, modify application state, and disrupt ColdFusion services.

At publication, there is no public proof-of-concept and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is low, reflecting the local attack vector requirement.

Root Cause

The root cause is an authorization logic defect inside ColdFusion. The product fails to validate that the authenticated principal is permitted to invoke a privileged operation. This gap allows a low-privileged account to invoke functionality that leads to code execution.

Attack Vector

The attack vector is local (AV:L) and requires low privileges (PR:L). An attacker must first obtain an authenticated foothold on a system running ColdFusion, for example a shared application host or a developer workstation. From that foothold, the attacker invokes the affected ColdFusion functionality to bypass authorization and execute code in the current user context. No user interaction is required.

No verified exploit code is publicly available. Refer to the Adobe ColdFusion Security Bulletin APSB26-144 for vendor technical details.

Detection Methods for CVE-2026-105901

Indicators of Compromise

Unexpected child processes spawned by the ColdFusion application server (coldfusion.exe, jrun.exe, or the JVM process) such as cmd.exe, powershell.exe, or shell interpreters
New or modified .cfm, .cfc, or .jsp files written to ColdFusion web roots outside of change windows
Administrative or scheduled task creation events originating from low-privileged ColdFusion user contexts

Detection Strategies

Baseline the normal process tree for ColdFusion and alert on deviations, particularly interpreter or scripting host launches
Correlate ColdFusion authentication events with subsequent privileged operations to surface authorization bypass patterns
Monitor ColdFusion administrator and scheduled task endpoints for access from accounts that should not hold those privileges

Monitoring Recommendations

Enable verbose ColdFusion application and audit logging and forward it to a centralized analytics platform
Alert on file writes to ColdFusion web directories by the ColdFusion service account
Track outbound connections from the ColdFusion server to non-approved destinations as a post-exploitation signal

How to Mitigate CVE-2026-105901

Immediate Actions Required

Apply the ColdFusion updates referenced in Adobe security bulletin APSB26-144 to all affected instances
Inventory every ColdFusion host, including development and staging environments, and prioritize internet-adjacent systems
Restrict local and interactive login rights on ColdFusion servers to the minimum set of administrators
Rotate credentials and session tokens for any accounts that could have authenticated to a vulnerable instance

Patch Information

Adobe addressed CVE-2026-105901 in the ColdFusion update documented in Adobe Security Bulletin APSB26-144. Administrators should review the bulletin for the full list of fixed versions and installation instructions, then validate the update level after deployment.

Workarounds

Enforce least privilege on ColdFusion service accounts so that a successful bypass yields the smallest possible execution context
Segment ColdFusion servers from general user workstations to reduce the pool of accounts that can reach the local attack surface
Disable or lock down the ColdFusion Administrator interface and unused components where business requirements allow

bash

# Configuration example: restrict interactive logon to ColdFusion hosts (Linux)
# /etc/security/access.conf
-:ALL EXCEPT root cfadmins:ALL

# Verify installed ColdFusion build after patching
/opt/coldfusion/cfusion/bin/coldfusion status