Adobe ColdFusion CVE-2026-71385

Exploitation requires (1) an attacker positioned on the adjacent administrative network zone, since the vulnerable component is restricted to that zone by default (AV:A), and (2) an account with high privileges on ColdFusion (PR:H) - this is not remotely reachable or exploitable by an unauthenticated internet attacker in a default deployment. No user interaction is required (UI:N), and attack complexity is low (AC:L) once those two prerequisites are met. The primary limiting factors are therefore the required administrative network placement and the pre-existing high-privilege authentication; organizations that strictly segment the ColdFusion admin zone and tightly control high-privilege accounts substantially reduce exposure. Affected deployments are ColdFusion 2025 (≤2025.0.13) and ColdFusion 2023 (≤2023.0.25); upgrade per Adobe APSB26-144.

This is a genuinely serious flaw (CVSS 8.4) but with meaningful real-world constraints that place it below the 'drop-everything' tier. The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is internally consistent with the description: exploitation requires an adjacent-network position AND high privileges (PR:H), and the vulnerable component is restricted to an administrative network zone by default. The scope change (S:C) plus triple-H impact reflects that successful exploitation yields arbitrary code execution that can affect resources beyond the vulnerable authorization component. Mitigating signals dominate the risk picture: there is no CISA KEV listing, no public POC referenced, and no EPSS score supplied, so there is no evidence of active or imminent mass exploitation. The dominant limiting factor is PR:H - an attacker must already hold high (administrative-level) privileges, meaning this is primarily a privilege/scope-escalation or post-compromise concern rather than a path for an external unauthenticated actor. Note a tension to flag: the Tags include 'Authentication Bypass,' yet both CWE-863 (Incorrect Authorization) and PR:H indicate the attacker must already be authenticated with high privileges - this is an authorization defect, not a pre-auth bypass, so the 'Authentication Bypass' framing should be verified against Adobe's advisory before treating it as unauthenticated.

An attacker who has already obtained high-privilege access to a ColdFusion administrative interface, and who sits on the adjacent administrative network segment, abuses the incorrect-authorization flaw to execute arbitrary code in the context of the current user. Because scope is changed, the resulting code execution can impact resources beyond the ColdFusion authorization boundary. No public exploit identified at time of analysis, so this would require a bespoke exploit against the specific authorization logic.