CVE-2026-106613 ColdFusion | Improper Input Validation (CWE-20)

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-106624 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require...

CVE-2026-106624

ColdFusion is affected by an Improper Control of Generation of Code (Code Injection) vulnerability (CWE-94). This flaw allows an attacker to execute arbitrary code within the context of the current user. The vulnerability can be exploited remotely without any user interaction. While the descripti...

CVE-2026-106614 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control...

CVE-2026-106621

ColdFusion is affected by an Improper Control of Generation of Code (Code Injection) vulnerability (CWE-94). This flaw could allow an attacker to achieve arbitrary code execution within the context of the current user. Notably, the exploitation of this vulnerability does not require any user inte...

CVE-2026-106621 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require...

CVE-2026-90530

ColdFusion RDS is vulnerable to a path traversal vulnerability (CWE-22) due to improper limitation of pathnames to a restricted directory. This flaw could allow an attacker to perform arbitrary file system reads , accessing sensitive files and directories outside the intended scope. The vulnerabi...

CVE-2026-90530 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...

CVE-2026-105898

ColdFusion is affected by an Incorrect Authorization vulnerability (CWE-863) that could lead to arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this issue, though the attack requires user interaction to open a malicious file. The impact is charac...

CVE-2026-105898 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a...

CVE-2026-105903 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue doe...

CVE-2026-105903

Adobe ColdFusion is affected by an Improper Control of Generation of Code (Code Injection) vulnerability (CWE-94). This flaw allows a low-privileged attacker to execute arbitrary code in the context of the current user without any user interaction. The vulnerability is reachable via the network a...

CVE-2026-75994 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by...

CVE-2026-106090 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-106090

ColdFusion is affected by an Incorrect Authorization vulnerability (CWE-863). A low-privileged attacker could exploit this flaw to achieve arbitrary code execution within the context of the current user. This vulnerability does not require any user interaction. While the documentation confirms th...

CVE-2026-75994

ColdFusion is affected by an Incorrect Authorization vulnerability (CWE-863) that may lead to arbitrary code execution within the context of the current user. The vulnerability allows an attacker to execute arbitrary code without user interaction. While the vulnerable component is restricted to a...

CVE-2026-106612

Adobe ColdFusion is affected by an Incorrect Authorization vulnerability (CWE-863) that can lead to arbitrary code execution within the context of the current user. A low-privileged attacker can exploit this flaw without requiring any user interaction. The CVSS 3.1 score is 9.9 (CRITICAL) with a ...

CVE-2026-106612 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-106615 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-106615

Adobe ColdFusion is affected by an Incorrect Authorization vulnerability (CWE-863 ) that allows a low-privileged attacker to achieve arbitrary code execution within the context of the current user. This vulnerability can be exploited without any user interaction. The provided documents do not spe...