CVE-2026-71385: 
Adobe ColdFusion vulnerability analysis and mitigation

CVE-2026-71385 is an Incorrect Authorization vulnerability in Adobe ColdFusion that allows an attacker with high privileges on an adjacent network to execute arbitrary code in the context of the current user. It affects ColdFusion 2025 (versions up to and including 2025.0.13) and ColdFusion 2023 (versions up to and including 2023.0.25). The vulnerability was disclosed on August 11, 2026, with a security update released the same day. It carries a CVSS v3.1 base score of 8.4 (High) (Adobe Advisory, GitHub Advisory).

The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the product does not correctly perform authorization checks when an actor attempts to access a resource or perform an action. The attack vector is adjacent network (AV:A), requiring the attacker to be on the same network segment as the vulnerable ColdFusion administrative interface, which is restricted to an administrative network zone by default. Exploitation requires high privileges but no user interaction, and the scope is changed — meaning a successful exploit can impact resources beyond the vulnerable component itself (Adobe Advisory, GitHub Advisory).

Successful exploitation allows a high-privileged attacker on an adjacent network to execute arbitrary code in the context of the current ColdFusion user, with high impact to confidentiality, integrity, and availability. This could enable privilege escalation, bypass of security features, unauthorized data access, data manipulation, and application denial-of-service. The changed scope indicates that exploitation may affect components or resources beyond the ColdFusion instance itself, increasing the potential for lateral movement within the environment (Adobe Advisory, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for high privileges and adjacent network access to the ColdFusion administrative zone, which limits the attacker pool.

Adobe has released patched versions addressing this vulnerability: ColdFusion 2025 update 2025.0.14 and ColdFusion 2023 update 2023.0.26. Administrators should apply these updates immediately via the Adobe security advisory. As a network-level workaround, restrict adjacent network access to the ColdFusion administrative interface using firewall rules or network segmentation to limit exposure. Monitor for suspicious privilege escalation attempts and unauthorized code execution on affected systems (Adobe Advisory).

The vulnerability received coverage from several cybersecurity news outlets and threat intelligence platforms shortly after Adobe's August 2026 patch release. Coverage appeared on CyberSecurityNews, GBHackers, and Cryptika, generally noting the arbitrary code execution risk in ColdFusion. The Center for Internet Security (CIS) also issued an advisory noting multiple Adobe vulnerabilities could allow for arbitrary code execution. No notable individual researcher commentary or significant social media debate has been identified (CIS Advisory, CyberSecurityNews, GBHackers).