CVE-2026-105898High· 8.2▾ TwilightColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Ex…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75994Critical· 9.6ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user
CVE-2026-71385High· 8.4ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user
CVE-2026-90530Critical· 9.3ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read
CVE-2026-75995High· 8.4ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user
CVE-2026-75996High· 7.5ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service
CVE-2026-76001High· 7.1ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation