EXPOSURES › CVE-2026-106620
CVE-2026-106620
CRITICALColdFusion has an incorrect authorization flaw allowing low-privileged attackers to bypass security and gain unauthorized write access without user interaction.
This vulnerability enables an attacker to bypass security controls and gain unauthorized write access to the system without requiring user interaction, posing a significant risk to data integrity and confidentiality. DIB organizations must ensure their ColdFusion deployments are patched immediately to prevent unauthorized access and potential data breaches. Failure to patch this vulnerability could lead to compliance violations under NIST 800-171 and CMMC standards.
Shame score — The vulnerability allows unauthorized write access without user interaction, indicating a serious authorization flaw that could be exploited in the wild.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.