Is CVE-2026-105994 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105994 being exploited in the wild.

How severe is CVE-2026-105994?

High severity, with a CVSS score of 7.7, published 13 October 2026.

Which products and versions are affected?

Adobe ColdFusion 2023 2023.0.25 and earlier; Adobe ColdFusion 2025 2025.0.13 and earlier.

How is CVE-2026-105994 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105994?

Check whether you run Adobe ColdFusion 2023 or Adobe ColdFusion 2025 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105994: Adobe ColdFusion authorization bypass security feature bypass

CVE-2026-105994 · Severity: high · CVSS 7.7 · Published 2026-10-13

Adobe ColdFusion, an enterprise web application server, is affected by an incorrect authorization vulnerability that allows low-privileged attackers to bypass security controls and gain unauthorized write access. This vulnerability requires no user interaction and changes the scope of impact, potentially affecting other connected systems. Exploitation could enable attackers to modify files or circumvent security policies without administrative credentials.

Technologies: Adobe ColdFusion 2023, Adobe ColdFusion 2025. Vendors: Adobe.

Quick answers

Is CVE-2026-105994 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105994 being exploited in the wild.
How severe is CVE-2026-105994?: High severity, with a CVSS score of 7.7, published 13 October 2026.
Which products and versions are affected?: Adobe ColdFusion 2023 2023.0.25 and earlier; Adobe ColdFusion 2025 2025.0.13 and earlier.
Is there a fix for CVE-2026-105994?: Yes: fixed in ColdFusion 2025.0.14, ColdFusion 2023.0.26. Until then: For security reasons, Adobe recommends using the latest MySQL Java connector and reviewing the updated serial filter documentation to protect against insecure deserialization attacks.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105994 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105994?: Check whether you run Adobe ColdFusion 2023 or Adobe ColdFusion 2025 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: ColdFusion 2025.0.14, ColdFusion 2023.0.26

For security reasons, Adobe recommends using the latest MySQL Java connector and reviewing the updated serial filter documentation to protect against insecure deserialization attacks.</anigation> </invoke>

Technical details

CVE-2026-105994 is an incorrect authorization flaw (CWE-863) in Adobe ColdFusion that permits security feature bypass. A low-privileged, authenticated attacker can exploit this vulnerability over the network without user interaction to achieve unauthorized write access. The vulnerability is part of a larger advisory addressing multiple critical issues in ColdFusion 2025 and 2023 versions, with fixes available in ColdFusion 2025.0.14 and 2023.0.26.

Affected products

Adobe ColdFusion 2025 2025.0.13 and earlier
Adobe ColdFusion 2023 2023.0.25 and earlier

Timeline

2026-10-13: disclosed

References

https://www.adobe.com/trust/security/products/coldfusion/apsb26-144.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.