CVE-2026-106089

Executive Summary

CVE-2026-106089 is an Incorrect Authorization (CWE-863) vulnerability affecting Adobe ColdFusion that permits a low-privileged attacker to execute arbitrary code in the context of the current user. Exploitation requires local access (AV:L) and low privileges (PR:L), but does not require user interaction (UI:N); the scope is changed (S:C), indicating the vulnerable component can impact resources beyond its original security context. With a CVSS base score of 8.8 and no public PoC, no Nuclei template, and no CISA KEV listing, the immediate exploit risk is moderate but the integrity and availability impact on unpatched ColdFusion deployments is severe.

Technical Analysis

The vulnerability class is Incorrect Authorization, tracked as CWE-863. This class encompasses cases where a software component performs an authorization check but does so incorrectly — for example, validating a privilege level that can be satisfied or bypassed by a low-privileged user, or applying a check to the wrong resource. In the context of Adobe ColdFusion, an application server that exposes administrative and application-level functionality, an authorization flaw can allow a user who should be restricted to lower-privileged operations to reach functionality that performs code execution.

The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H provides the following technical signals:

• Attack Vector (Local): The attacker requires local access to the target system or a local foothold. This reduces the exposure compared to a network-only vector but does not eliminate risk in multi-tenant, shared-hosting, or containerized ColdFusion deployments where multiple principals coexist on the same host.
• Attack Complexity (Low): No race conditions, no specialized environmental prerequisites, and no unusual memory-layout manipulation are required. The authorization failure is deterministic once the precondition (local access + low privilege) is met.
• Privileges Required (Low): The attacker does not need administrative rights on the host. Any authenticated but low-privileged account — for example a standard application user or a hosting tenant — is sufficient.
• User Interaction (None): No victim action (link click, file open) is needed. The attacker can trigger the flaw directly.
• Scope (Changed): The vulnerable component's authorization boundary is crossed. A low-privileged actor operating within one security context can affect resources in another, which is why scope is recorded as Changed.
• Confidentiality/Integrity/Availability (High/High/High): Full loss of confidentiality, integrity, and availability is possible following successful code execution.

The published description states that exploitation results in arbitrary code execution in the context of the current user. Because the NVD description provides no function names, class names, URL endpoints, file paths, or API parameters, the precise internal mechanism — whether the failure is in an administrative API, a task execution feature, an access control on a service endpoint, or a role-mapping table — cannot be stated with confidence. What can be stated is the vulnerability class: an authorization decision that should deny a low-privileged user's request is either absent or incorrectly evaluated, and the reachable operation permits code execution under that user's context.

Given that scope is Changed, the practical consequence is escalation across a trust boundary: the low-privileged principal gains the ability to influence or execute code that runs with the privileges of the ColdFusion process or another security context. This is consistent with authorization flaws in application servers where a restricted role can invoke server-side execution primitives.

No vendor advisory, affected version enumeration, or patch reference was available from any tracked source at the time of writing. Affected version ranges are therefore unknown, and no workarounds have been published.

Exploitation Scenarios

Because no public PoC, Nuclei template, or exploit code exists, the following attack chain is inferred strictly from the vulnerability class (Incorrect Authorization leading to arbitrary code execution) and the CVSS vector. No specific function names, endpoints, or parameters are asserted.

1. Reconnaissance and target identification. The attacker identifies an Adobe ColdFusion instance on a host to which they have local access, or gains an initial low-privileged foothold via a separate vector (for example, a shared hosting account, a container with a mounted ColdFusion installation, or a low-privileged OS account with network access to the local service). Fingerprinting focuses on identifying ColdFusion installations and the privilege level of the available account.

2. Triggering the authorization flaw. The attacker invokes functionality that is reachable with low privileges but that performs an authorization check incorrectly under CWE-863. Because Attack Complexity is Low and User Interaction is None, the attacker can directly submit requests or invoke operations that the flawed check permits, rather than denies. The precise reachable interface cannot be specified from the available description; at the vulnerability-class level, the attacker exercises a server-side operation that should require a higher privilege than the one held.

3. Execution at the vulnerability-class level. The mis-authorized operation results in code execution in the context of the current user. The attacker does not need to construct a memory-corruption exploit or win a race; the authorization bypass itself is the primary primitive. At this stage the attacker's code runs with the privileges of the ColdFusion process or the security context reached by the flawed authorization decision.

4. Post-exploitation impact. With arbitrary code execution confirmed, the attacker can read and modify application data and configuration (High Confidentiality and Integrity impact), disrupt the service (High Availability impact), and, because Scope is Changed, affect resources beyond the original security context. Typical follow-on actions include establishing persistence, harvesting credentials and secrets accessible to the compromised process, and pivoting to adjacent systems reachable from the ColdFusion host. No public exploit-in-the-wild evidence is available, and no threat actor campaigns have been attributed.

Impact Assessment

The CVSS base score is 8.8 (High), derived from a locally reachable, low-complexity, low-privilege, no-interaction flaw with Changed Scope and High impacts across Confidentiality, Integrity, and Availability. The business impact is significant for any organization running an unpatched ColdFusion deployment on a host where low-privileged principals exist:

• Confidentiality (High): arbitrary code execution in the current user's context exposes application data, configuration, and any secrets reachable by that process.
• Integrity (High): the attacker can modify application state, configuration, and potentially deployed code.
• Availability (High): service disruption or destruction of the ColdFusion instance is possible.
• Scope (Changed): the flaw's impact is not confined to the vulnerable component's own security authority, meaning a low-privileged actor can affect resources in a different context.

Blast radius depends heavily on deployment topology. In single-tenant, internet-isolated installations where no untrusted local users exist, the practical exposure is lower because the AV:L precondition is harder to satisfy. In shared hosting, multi-tenant container platforms, CI/CD build agents, or jump hosts where multiple low-privileged users share the ColdFusion host, the risk is materially higher. Because no patch exists and no CISA KEV listing is present, this vulnerability is currently a latent risk rather than an actively exploited one; however, unpatched status means defenders cannot rely on vendor remediation as a boundary.

Detection Guidance

Sigma Rule

title: Possible ColdFusion Incorrect Authorization Exploitation (CVE-2026-106089)
id: 8f2c1a6e-4b7d-4e2a-9c1f-3d5a7b9e0c11
status: experimental
description: Detects anomalous low-privileged local access to ColdFusion processes or configuration consistent with authorization bypass leading to code execution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106089
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_cf_process:
    Image|endswith:
      - '\coldfusion.exe'
      - '\jrun.exe'
  selection_susp_child:
    ParentImage|endswith:
      - '\coldfusion.exe'
      - '\jrun.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\bash'
      - '\sh'
  condition: selection_cf_process and selection_susp_child
falsepositives:
  - Legitimate scheduled administrative tasks spawning shells
level: high
tags:
  - attack.t1190
  - cve.2026.106089

YARA Rule

rule CVE_2026_106089_ColdFusion_Incorrect_Authorization
{
    meta:
        description = "Heuristic detection of ColdFusion authorization-bypass artifacts referenced in CVE-2026-106089"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106089"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cf1 = "ColdFusion" ascii wide nocase
        $cf2 = "CFIDE" ascii wide nocase
        $cf3 = "cfusion" ascii wide nocase
        $auth1 = "Incorrect Authorization" ascii wide nocase
        $auth2 = "CWE-863" ascii wide

    condition:
        uint32(0) == 0x464c457f or uint16(0) == 0x5a4d or true
        and 1 of ($cf1, $cf2, $cf3)
        and 1 of ($auth1, $auth2)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 8500 (msg:"CVE-2026-106089 Possible Adobe ColdFusion Incorrect Authorization Exploitation Attempt"; flow:to_server,established; content:"ColdFusion"; nocase; http_header; content:"Authorization"; nocase; http_header; classtype:attempted-admin; reference:cve,2026-106089; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106089; sid:2026106089; rev:1;)
alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-106089 ColdFusion Administrative Access Anomaly"; flow:to_server,established; content:"CFIDE"; nocase; http_uri; classtype:attempted-admin; reference:cve,2026-106089; sid:2026106090; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name : ("coldfusion.exe", "jrun.exe", "java") and
  process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "sh", "bash") and
  process.args : ("*ColdFusion*", "*CFIDE*", "*cfusion*")

Splunk SPL Query

index=main (sourcetype=coldfusion OR sourcetype=cf_log OR source="*coldfusion*")
| search ("ColdFusion" OR "CFIDE" OR "cfusion")
| search ("authorization" OR "authoriz" OR "CWE-863" OR "unauthorized" OR "privilege")
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as hosts values(src) as sources by user, action
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="coldfusion,cve-2026-106089,">
  <rule id="1060891" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.category">process</field>
    <field name="process.parent.name">coldfusion.exe|jrun.exe</field>
    <field name="process.name">cmd.exe|powershell.exe|wscript.exe|cscript.exe|sh|bash</field>
    <description>CVE-2026-106089: Suspicious child process spawned by ColdFusion - possible authorization bypass code execution</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106089,</group>
  </rule>
  <rule id="1060892" level="10">
    <decoded_as>json</decoded_as>
    <field name="url.path">CFIDE|cfusion</field>
    <field name="http.response.status_code">200</field>
    <description>CVE-2026-106089: Possible ColdFusion administrative endpoint access anomaly</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106089,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict local access to ColdFusion hosts to trusted administrators only. Because the attack vector is Local and Privileges Required is Low, reducing the population of low-privileged local accounts directly reduces exposure.
• Apply network segmentation so that low-privileged tenants, build agents, and shared-hosting users cannot reach ColdFusion service interfaces or configuration directories.
• Enforce least privilege on all local accounts and service accounts; audit for unnecessary interactive logon rights on ColdFusion servers.
• Monitor for anomalous child processes spawned by the ColdFusion/Java process and for access to administrative interfaces from low-privileged contexts.
• Since no vendor workaround is published, consider isolating high-value ColdFusion instances and increasing logging verbosity pending a patch.

2. Patch/upgrade steps:

• No patch reference is currently available from any tracked source. Monitor the Adobe ColdFusion security bulletin channel and the NVD entry for CVE-2026-106089 for an authoritative fixed-version reference.
• Do not apply untrusted third-party fixes. Once Adobe publishes a fixed version, upgrade all ColdFusion instances and verify the build number matches the fixed release.

3. Long-term hardening:

• Adopt a vendor patch-tracking process with defined SLAs for application-server components.
• Reduce the local attack surface by minimizing accounts on ColdFusion hosts and disabling unnecessary services.
• Enforce authorization reviews across ColdFusion applications, ensuring role-to-operation mappings are validated and tested.
• Deploy file integrity monitoring and process-lineage detection on all ColdFusion hosts.

References

1. NVD — CVE-2026-106089: https://nvd.nist.gov/vuln/detail/CVE-2026-106089
2. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
3. Adobe Security Bulletins (ColdFusion) — https://helpx.adobe.com/security/security-bulletin.html (check for authoritative patch advisory)
4. FIRST EPSS — not yet scored for this CVE at time of writing: https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-106089 not listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No exploit-in-the-wild evidence, public PoC, or attributed threat actor campaign was available for CVE-2026-106089 at the time of writing.