CVE-2026-71384: 
Adobe ColdFusion vulnerability analysis and mitigation

CVE-2026-71384 is an Incorrect Authorization (CWE-863) vulnerability in Adobe ColdFusion that allows unauthenticated attackers on an adjacent network to bypass security controls and gain unauthorized read and write access, potentially causing a denial-of-service condition. It affects Adobe ColdFusion 2025 (versions up to and including 2025.0.11) and ColdFusion 2023 (versions up to and including 2023.0.22). The vulnerability was disclosed and patched on August 11, 2026, under Adobe security bulletin APSB26-90. It carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory, Adobe Advisory).

The vulnerability stems from incorrect authorization checks (CWE-863) within Adobe ColdFusion's administrative interface, which is restricted to an administrative network zone by default. An attacker positioned on the adjacent network can exploit this flaw without any privileges or user interaction, bypassing security measures to perform unauthorized read and write operations. The changed scope indicator in the CVSS vector suggests that successful exploitation can impact resources beyond the vulnerable component itself. No public proof-of-concept or detailed technical write-up has been identified at this time (GitHub Advisory, Adobe Advisory).

Successful exploitation grants an unauthenticated adjacent-network attacker full confidentiality, integrity, and availability impact — they can read sensitive application data, write or modify application state, and potentially crash the ColdFusion service, resulting in a denial-of-service condition. The changed scope means the impact can extend beyond the ColdFusion application itself to other components within the environment. Given ColdFusion's typical role in enterprise web application hosting, compromise could expose sensitive business data and enable further lateral movement within the administrative network zone (GitHub Advisory, Adobe Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2026-71384. The EPSS score is approximately 0.243% (16th percentile), indicating a relatively low near-term exploitation probability. The NVD SSVC assessment classifies exploitation as "none" and automatable as "no" at the time of publication. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest available data (GitHub Advisory, Adobe Advisory).

Adobe has released patched versions addressing this vulnerability: ColdFusion 2025 update 2025.0.12 and ColdFusion 2023 update 2023.0.23. Organizations should apply these updates immediately. As an interim measure, restrict network access to ColdFusion administrative interfaces to trusted networks only, and monitor for suspicious adjacent-network connections or unauthorized data access attempts. The vulnerable component is restricted to the administrative network zone by default, so ensuring proper network segmentation provides an additional layer of defense (Adobe Advisory, GitHub Advisory).

Adobe's August 2026 patch release received notable media attention, with SecurityWeek and The Hacker News reporting on the batch of critical ColdFusion fixes — including multiple CVSS 10.0-rated vulnerabilities patched in the same release cycle — urging immediate patching (SecurityWeek, The Hacker News). CIS issued an advisory noting that multiple vulnerabilities in Adobe products could allow for arbitrary code execution (CIS Advisory). Security community coverage from outlets such as CyberSecurityNews and GBHackers highlighted the severity of the ColdFusion vulnerabilities and the importance of prompt remediation (CyberSecurityNews, GBHackers).