CVE-2026-106089

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

• CWE-863

• https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.htmlVendor Advisory

Published

Oct 13, 2026

Last Modified

Oct 16, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-106065A heap-based buffer overflow was found in GIMP’s PCX export …6.3
• CVE-2026-106066A heap-based buffer overflow was found in GIMP’s raw data ex…6.3
• CVE-2026-106067A heap-based buffer overflow was found in GIMP’s Hot color f…6.3
• CVE-2026-106068Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-10607A vulnerability was identified in DedeCMS 5.7.88. The impact…7.3
• CVE-2026-10608A security flaw has been discovered in DedeCMS 5.7.88. This …7.3
• CVE-2026-10609A missing authorization flaw was found in the OpenShift Clus…6.8
• CVE-2026-106090ColdFusion is affected by an Incorrect Authorization vulnera…8.8
• CVE-2026-106095The Code Snippets WordPress plugin before 3.10.0 does not pe…3.3
• CVE-2026-106097The Code Snippets WordPress plugin before 3.10.0 does not sa…6.8
• CVE-2026-106098The WP Data Access WordPress plugin before 5.5.77 does not …5.3
• CVE-2026-106099The WP Data Access WordPress plugin before 5.5.84 does not …5.3