CVE-2026-71387: 
Adobe ColdFusion vulnerability analysis and mitigation

CVE-2026-71387 is an Incorrect Authorization vulnerability (CWE-863) in Adobe ColdFusion that allows unauthenticated attackers on an adjacent network to execute arbitrary code in the context of the current user without any user interaction. It affects Adobe ColdFusion 2023 (all updates through 2023.0.22) and ColdFusion 2025 (all updates through 2025.0.11). The vulnerability was published on August 11, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Adobe Advisory).

The vulnerability stems from incorrect authorization checks (CWE-863) within a ColdFusion administrative component, meaning the product fails to properly verify whether an actor is permitted to access a resource or perform an action. The attack vector is adjacent network (AV:A), requiring the attacker to be on the same network segment or administrative network zone as the vulnerable component — which Adobe notes is restricted to an administrative network zone by default. No privileges or user interaction are required, and attack complexity is low, making exploitation straightforward for any attacker with adjacent network access. No public proof-of-concept code has been identified at this time (GitHub Advisory, Adobe Advisory).

Successful exploitation results in arbitrary code execution in the context of the ColdFusion process user, with high impact to confidentiality, integrity, and availability of the affected system. An attacker could read sensitive data, modify application files or configurations, and disrupt service availability. Given ColdFusion's typical role as a web application server, compromise could expose backend databases, application credentials, and enable lateral movement within the administrative network (GitHub Advisory, Adobe Advisory).

As of the time of disclosure, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.271% (19th percentile), indicating a relatively low near-term exploitation probability. The NVD SSVC assessment notes exploitation as "none" and the attack is not automatable due to the adjacent network requirement. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Adobe Advisory).

Adobe has released patched versions addressing this vulnerability: ColdFusion 2025 Update 12 (2025.0.12) and ColdFusion 2023 Update 23 (2023.0.23). Organizations should apply these updates immediately. As an interim measure, ensure the vulnerable ColdFusion administrative component remains strictly restricted to authorized administrative network zones and is not accessible from untrusted network segments. Network-level controls such as firewall rules limiting access to the administrative interface should be enforced (Adobe Advisory, GitHub Advisory).

The vulnerability was covered by several cybersecurity news outlets following Adobe's August 2026 patch release, including CyberSecurityNews and GBHackers, which reported on multiple Adobe ColdFusion vulnerabilities addressed in the same advisory. The Center for Internet Security (CIS) issued an advisory noting that multiple vulnerabilities in Adobe products could allow for arbitrary code execution. FortiGuard also added IPS coverage for the vulnerability. Community reaction has been moderate given the adjacent-network-only attack vector, which limits the exposure compared to fully remote vulnerabilities (CIS Advisory, CyberSecurityNews, GBHackers).