VulnSocial

CVE-2026-106618(adobe / coldfusion)

LOWCVSS 8.8 · HIGH

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

adobe CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • coldfusion

Affected systems

Vendors
adobe
Products
coldfusion

2 versions affected across 1 product

Deep dive

Full discourse1 post
  • enes sönmez@enes_dev

    🚨🚨🚨🚨🚨🚨🚨 Quick fix for php2shell 🚨🚨🚨🚨🚨🚨🚨 php2shell | CVE-2026-106618 & CVE-2026-109619 PHP >5.4.0 environments may be affected. (CVSS 9.2 each) 👉 Quick mitigation: Disable session.upload_progress.enabled across all php.ini files to reduce exposure. locate php.ini | grep -E '/php\.ini$' | xargs -r sed -i -E 's/^[[:space:]]*;?[[:space:]]*session\.upload_progress\.enabled[[:space:]]*=.*/session.upload_progress.enabled = Off/' ⚠️ Restart/reload PHP services to apply changes. This is a mitigation, not a full patch. Fixes scheduled for October 21, 14:00 UTC. Share this.

    131552.6K
    1.1K followersView on X
CPE platform detail39 entries

39 of 39 entries

PartVendorProductVersionTarget SWTarget HW
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--

Explore more

Back to dashboardadobe CVEscoldfusion vulnerabilities