CVE-2026-106090

Executive Summary

CVE-2026-106090 is an Incorrect Authorization vulnerability (CWE-863) affecting ColdFusion that allows a low-privileged attacker to execute arbitrary code in the context of the current user with a changed scope. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and requires no user interaction, though it is assessed as requiring local access (AV:L) with low privileges (PR:L). No public proof-of-concept, exploit code, Nuclei template, or CISA KEV listing exists at the time of writing, and no patch evidence has been identified from any tracked source, leaving the exposure UNPATCHED.

Technical Analysis

CVE-2026-106090 is classified under CWE-863: Incorrect Authorization. This weakness class describes a condition in which an application performs an authorization check, but the check is implemented incorrectly — permitting an actor to perform an action, access a resource, or operate in a security context that the intended authorization logic should have denied. Unlike a missing authorization check (CWE-862), an incorrect authorization check implies a flawed verification that can be bypassed or that evaluates the wrong principal, role, or scope.

The NVD description states the issue affects ColdFusion and that successful exploitation "could result in arbitrary code execution in the context of the current user." The description also specifies that "a low-privileged attacker could exploit this vulnerability to execute arbitrary code" and that "exploitation of this issue does not require user interaction." Critically, the CVSS vector reports Scope is changed (S:C), meaning a successful exploit can affect resources beyond the security scope controlled by the vulnerable component — the authorization boundary that the flawed check was intended to enforce. The vector further reports High confidentiality, integrity, and availability impacts (C:H/I:H/A:H).

Because the CVSS vector specifies AV:L (Local) and PR:L (Low privileges), the attack is assessed as requiring a local foothold and low-privileged access rather than being exploitable remotely and unauthenticated. The incorrect authorization component allows that low-privileged position to escalate into arbitrary code execution, consistent with a broken access-control boundary where a low-privileged identity is incorrectly granted privileges that should belong to a higher-privileged identity or internal scope.

Important limitation: The provided intelligence contains no CNA Title, no affected version range, no OSV package data, and no vendor advisory. Accordingly, no specific function names, class names, URL endpoints, file paths, or API parameters are available and none are asserted here. The precise authorization check that is flawed, the components involved, and the code path are not derivable from the supplied data. No public PoC exists; the attack chain below is inferred strictly at the vulnerability-class level (incorrect authorization leading to code execution) and must not be read as a description of a confirmed implementation detail.

Exploitation Scenarios

The following describes the attack chain at the vulnerability-class level, using only facts asserted in the NVD description and CVSS vector. No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-863, Incorrect Authorization). No specific endpoints, parameters, or code constructs are asserted because none are provided in the source data.

1. Reconnaissance / Target Identification. An adversary first identifies an internet- or network-reachable ColdFusion deployment. Given AV:L and PR:L, the realistic threat model involves an attacker who already holds a low-privileged account or a low-integrity foothold on or adjacent to the host (for example, a standard application user, a compromised low-privileged session, or a co-resident process). The attacker enumerates the ColdFusion instance and its accessible surfaces to locate the authorization boundary that is improperly enforced.

2. Triggering the Incorrect Authorization Flaw. The attacker performs an action that the flawed authorization logic fails to validate correctly. Because the weakness is Incorrect Authorization (CWE-863), the check is present but evaluates incorrectly — for example, it may validate the wrong principal, misapply a role or scope comparison, or fail to enforce the boundary for a particular operation. The attacker leverages their low-privileged context to reach an operation that should have been gated to a higher privilege or a different scope. Per the CNA description, this step does not require user interaction, so no victim action or social engineering is necessary.

3. Execution Method (Class-Level). Successful abuse of the incorrect authorization decisions allows the attacker to execute arbitrary code "in the context of the current user." Because the CVSS scope is changed (S:C), the impact extends beyond the boundary the vulnerable authorization logic was intended to protect. The mechanism by which code is executed is not specified in the source data; at the vulnerability-class level, this is an authorization-check bypass that yields code execution under the compromised identity's context.

4. Post-Exploitation Impact. With High confidentiality, integrity, and availability impact, the attacker can read sensitive data accessible to that execution context, modify data or configuration, and disrupt availability within the reached scope and, due to the scope change, potentially beyond it. Because the vulnerability enables code execution in "the context of the current user," the ultimate blast radius is bounded by the privileges of that context but can be amplified by the scope-change characteristic.

Impact Assessment

CVE-2026-106090 has a CVSS v3.1 base score of 8.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Breaking this down strictly per the vector:

• Exploitability: Local access (AV:L) and low privileges (PR:L) are required, and no user interaction is needed (UI:N). The attack complexity is Low (AC:L), indicating no special conditions or race conditions are assumed.
• Scope: Changed (S:C) — the exploitation can impact resources beyond the authorization scope of the vulnerable component, which raises the severity relative to an unchanged-scope equivalent.
• Impact subscores: High Confidentiality, High Integrity, and High Availability impact. Successful exploitation yields arbitrary code execution, allowing disclosure of sensitive data, modification of data and configuration, and denial or disruption of service.

Business impact: A ColdFusion instance typically hosts business-critical web applications, integrations, and data. Arbitrary code execution under the current user's context — combined with the changed scope — creates a credible path to data exfiltration, application or server compromise, and lateral movement from the compromised execution context. Because a low-privileged attacker can trigger the flaw without user interaction, exposure is elevated wherever low-privileged access to a ColdFusion deployment is attainable (multi-tenant hosting, shared application accounts, or post-initial-access footholds).

Blast radius: Bounded by the privileges of the "current user" context, but the S:C designation indicates the impact is not confined to the vulnerable authorization boundary. Organizations running ColdFusion with low-privileged multiuser access or internet-exposed management/application surfaces should treat this as high priority. The absence of CISA KEV listing and public exploit means active exploitation is not confirmed, but the unpatched status and severity warrant preemptive defensive action.

Detection Guidance

Detection must be framed at the vulnerability-class level because no specific endpoints, parameters, or signatures are provided. Rules below target generic indicators of incorrect-authorization abuse and arbitrary code execution attempts against ColdFusion.

Sigma Rule

title: Potential ColdFusion Incorrect Authorization and Code Execution Activity
id: 7f3c2b91-4a6d-4e2f-9c1a-0b5e8d2f6a10
status: experimental
description: Detects suspicious process creation consistent with code execution following an authorization bypass on ColdFusion hosts (CVE-2026-106090 class).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106090
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\jrun.exe'
      - '\cfexec.exe'
      - '\java.exe'
  selection_suspicious:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\bash'
      - '\sh'
  filter_known:
    CommandLine|contains:
      - 'ColdFusion'
      - 'cfusion'
  condition: selection_parent and selection_suspicious and not filter_known
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
falsepositives:
  - Legitimate administrative scheduled tasks invoked by ColdFusion services
level: high

YARA Rule

rule CVE_2026_106090_ColdFusion_Authz_Exploit_Indicators
{
    meta:
        description = "Heuristic indicators of ColdFusion incorrect authorization exploitation (CVE-2026-106090). Generic class-level detection; no public PoC signature available."
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106090"
        severity = "high"

    strings:
        $cf1 = "CFIDE" ascii nocase
        $cf2 = "coldfusion" ascii nocase
        $cf3 = "cfusion" ascii nocase

        $authz1 = "authorization" ascii nocase
        $authz2 = "isAuthorized" ascii nocase
        $authz3 = "isUserInRole" ascii nocase

        $exec1 = "Runtime.getRuntime().exec" ascii
        $exec2 = "ProcessBuilder" ascii
        $exec3 = "getRuntime" ascii

    condition:
        (any of ($cf*)) and
        (any of ($authz*)) and
        (any of ($exec*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106090 Potential ColdFusion Incorrect Authorization - Code Execution Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"CFIDE"; nocase; http.header; content:"Cookie"; nocase; pcre:"/(\.\.|%2e%2e|adminapi|exp|exec|cmd)/Ui"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-admin; sid:2026106090; rev:1; reference:cve,2026-106090; metadata:affected_product Adobe_ColdFusion, created_at 2026_01_01;)

Note: This rule targets suspicious request patterns against ColdFusion interfaces and is heuristic; without a public PoC, exact exploit request signatures are unavailable.

Elastic Detection

process where event.type in ("start", "process_started") and
process.parent.name in ("jrun.exe", "cfexec.exe", "java.exe") and
process.name in ("cmd.exe", "powershell.exe", "bash", "sh", "wscript.exe", "cscript.exe") and
not process.command_line : ("*ColdFusion*", "*cfusion*")

Splunk SPL Query

index=main (sourcetype=WinEventLog:Security OR sourcetype=cfusion_log OR sourcetype=coldfusion)
| eval msg=coalesce(Message, _raw)
| where match(msg, "(?i)(authorization|access.?denied|CFIDE|exec|Runtime\.getRuntime|ProcessBuilder)")
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, msg
| where count > 5
| convert ctime(firstTime) ctime(lastTime)
| sort - count

Wazuh OSSEC Rule

<group name="coldfusion,cve-2026-106090,">
  <rule id="100690" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.type">authorization</field>
    <field name="app">ColdFusion</field>
    <description>CVE-2026-106090: Potential ColdFusion incorrect authorization leading to code execution</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, fixed version, or workaround has been identified. The following guidance is defensive and provisional.

1. Immediate mitigations (no patch available):

   • Restrict network exposure of ColdFusion instances — do not expose ColdFusion application or administrative surfaces to untrusted networks; enforce firewall/ACL restrictions and VPN-only administrative access.
   • Enforce least privilege: ensure ColdFusion services run under dedicated, minimally privileged OS accounts, and limit the number of low-privileged application users who can interact with the affected surface. Because the vulnerability requires low privileges (PR:L), reducing the population of low-privileged principals reduces exposure.
   • Apply strict WAF/edge filtering and monitor for anomalous requests to ColdFusion interfaces; block unexpected administrative or script-execution patterns.
   • Monitor and alert on process creation spawned by ColdFusion service processes (see Detection Guidance), since arbitrary code execution is the post-exploitation effect.

2. Patch/upgrade steps:

   • No patch is currently confirmed. Monitor the vendor's ColdFusion security bulletin channel and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-106090) for an official fix. When an advisory is released, validate the fixed version against your deployment, test in a staging environment, and apply promptly.
   • Track CISA KEV and vendor advisories for status changes; this CVE is currently NOT listed in KEV.

3. Long-term hardening:

   • Maintain a software inventory and vulnerability management cadence for ColdFusion and its dependencies.
   • Harden authorization design: review role and scope checks to ensure they evaluate the correct principal and enforce boundaries consistently (directly relevant to CWE-863).
   • Enable comprehensive logging, centralize it, and retain it for forensic analysis; correlate application authorization logs with OS process telemetry.
   • Segment ColdFusion hosts from high-value data and management networks to limit lateral movement given the changed-scope impact.

References

• NVD — CVE-2026-106090: https://nvd.nist.gov/vuln/detail/CVE-2026-106090
• CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
• FIRST EPSS: Not yet scored for CVE-2026-106090 (no EPSS value available at time of writing)
• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-106090 is NOT listed (no confirmed exploit-in-the-wild evidence)
• Vendor (Adobe ColdFusion) security bulletins: no advisory identified for this CVE in tracked sources

No public PoC, exploit code, or Nuclei template exists. No threat actor campaign has been attributed to this CVE in the provided intelligence. Exploit-in-the-wild evidence: none observed.