What is the CVSS score of CVE-2026-71383?

CVE-2026-71383 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Adobe ColdFusion are affected by CVE-2026-71383?

Adobe ColdFusion 2023 and 2025 deployments are exposed to unauthenticated remote attackers who can access and modify protected business data without authentication credentials.

How to fix or mitigate CVE-2026-71383?

Within 24 hours: Identify all ColdFusion 2023 and 2025 systems in production, map their network accessibility, and document which handle sensitive data or critical business functions. Within 7 days: Implement network segmentation using firewall rules to restrict ColdFusion access to authorized sources only, deploy WAF rules to monitor for exploitation attempts, and enable centralized logging of all ColdFusion application access. Within 30 days: Establish a weekly monitoring schedule for Adobe security advisories for patch availability; develop a pre-tested deployment plan for ColdFusion updates when released; evaluate whether air-gapping or end-of-life acceleration of affected versions is necessary depending on patch timeline from Adobe.

Adobe ColdFusion CVE-2026-71383

EUVD-2026-56548 HIGH

Incorrect Authorization (CWE-863)

2026-08-11 adobe

GHSA-3736-75wg-78gp

Authentication Bypass Adobe Coldfusion 2025 Coldfusion 2023

7.3

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-reachable with no authentication or interaction required; impact is uniformly Low across all three dimensions consistent with a partial authorization bypass, not full compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 17:23 vuln.today

CVE Published

Aug 11, 2026 - 16:31 nvd

HIGH 7.3

DescriptionCVE.org

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.

AnalysisAI

Incorrect Authorization in Adobe ColdFusion 2023 and 2025 enables unauthenticated remote attackers to bypass security controls and gain limited unauthorized read and write access to protected resources, with a limited disruption to availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication, no user interaction, and is reachable over the network under low complexity conditions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-863 (Incorrect Authorization) indicates the application performs authorization checks but implements them incorrectly - the logic is present but flawed, allowing an attacker to reach resources or operations they should be denied. This is distinct from missing authorization (CWE-862); the flaw is in the enforcement logic itself. Adobe ColdFusion is a commercial application server and scripting platform widely used for building enterprise web applications, often with direct exposure to the internet. The vulnerability affects two distinct product lines per CPE: cpe:2.3:a:adobe:coldfusion_2025 (all versions) and cpe:2.3:a:adobe:coldfusion_2023 (all versions), indicating the flaw spans at least two major release generations. The wildcard version in both CPEs suggests the precise fixed build has not been encoded in NVD CPE data at time of analysis.

RemediationAI

The primary remediation is to apply the patch referenced in Adobe Security Bulletin APSB26-90, available at https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html. The exact fixed build version is not independently confirmed from the available input data - consult the advisory directly to obtain the precise patched release for ColdFusion 2023 and ColdFusion 2025. As a compensating control prior to patching, restrict network access to ColdFusion administrative interfaces and application endpoints using firewall rules or WAF policies to limit exposure to trusted source IP ranges; note this reduces attack surface but does not eliminate the flaw in authorized traffic flows. Additionally, review ColdFusion lockdown guides to ensure non-default security settings are applied, particularly around request filtering and resource access controls.