Adobe ColdFusion CVE-2026-71384

Exploitation requires adjacent-network reachability to ColdFusion's administrative component (CVSS AV:A), which Adobe states is restricted to an administrative network zone by default - so the attacker must already be on, or able to route to, that management segment. No user interaction is required (UI:N) and no prior authentication is needed (PR:N), meaning that once network reach is achieved the incorrect-authorization flaw is directly triggerable. The primary limiting factors are therefore network placement (not remotely internet-triggerable in a properly segmented deployment) and the requirement that the target be a ColdFusion 2023 or 2025 instance; there is no version-specific configuration flag named in the description beyond the default admin-zone restriction.

The raw signals are severe: CVSS 9.6 with AV:A/AC:L/PR:N/UI:N/S:C and High confidentiality, integrity, and availability impact means low-effort, unauthenticated exploitation once an attacker reaches the relevant network segment, and a mid-sized municipal IT team in kalisz running an internet-exposed or flat-network ColdFusion instance should treat this as urgent. The strongest mitigating factor is the attack vector: it is Adjacent (AV:A), not Network, and Adobe notes the vulnerable component is restricted to an administrative network zone by default, so a correctly segmented deployment materially reduces exposure. There is no EPSS score, no SSVC decision data, no KEV listing, and no POC provided in this intelligence set, so exploitation probability is effectively unquantified - the high CVSS reflects impact potential, not demonstrated in-the-wild use; verify segmentation of the admin zone and prioritize patching, but do not assume mass exploitation without corroborating EPSS/KEV signals.

An attacker who gains a foothold on the administrative network segment (for example via a compromised management host or a flat network) sends crafted requests to the ColdFusion administrative component and, because the authorization check is incorrect, is granted read and write access without valid credentials. From there the attacker can tamper with application data or configuration and can degrade the service into a denial-of-service state. No public exploit is identified at time of analysis, so this scenario is inferred from the CVSS vector and description rather than a demonstrated POC.