Adobe ColdFusion CVE-2026-71386

The attacker must be positioned on the administrative network segment or have adjacent network access - the ColdFusion administrative component is restricted to this zone by default, which prevents direct internet-based exploitation. An administrative user must actively open a malicious file (UI:R), requiring the attacker to deliver the file and socially engineer the admin into interacting with it. No authentication is required of the attacker (PR:N per the CVSS vector), but this applies only within the administrative network boundary. Exploitation is blocked for: internet-facing unauthenticated attackers without network adjacency to the admin zone, non-administrative users without access to the ColdFusion Administrator interface, and environments where strict file-type allowlisting or sandboxed file preview prevents admin users from opening arbitrary external files.

The CVSS 8.8 score reflects genuinely high severity, though the AV:A (adjacent network) constraint is a meaningful risk moderator - exploitation is limited to attackers with access to the administrative network segment, which in well-segmented environments significantly reduces the exposed attack surface. The scope change (S:C) with C:H/I:H/A:H confirms that successful exploitation yields full system compromise, not merely browser-level script injection. No EPSS data was provided in the source intelligence, and the absence of a CISA KEV listing combined with no confirmed public exploit suggests this vulnerability has not yet seen widespread automated exploitation. Even a mid-sized municipal IT team in walbrzych running ColdFusion for internal line-of-business applications should treat this as urgent patching work given the full CIA impact and the relative ease of social engineering an admin into opening a malicious file once the attacker achieves adjacency (AC:L, UI:R). The UI:R requirement provides some theoretical friction but is not a reliable barrier in practice given the prevalence of phishing and shared network drive scenarios.

An attacker with access to the administrative network segment crafts a malicious file embedding an XSS payload designed to execute within ColdFusion's administrative interface - for example, a file that triggers server-side CFML processing when an admin opens or previews it. The attacker delivers this file to an administrative user via phishing, a shared network drive, or a support ticket workflow. When the admin opens the file through the ColdFusion interface, the injected script executes in the admin's browser session and leverages ColdFusion's server-side execution capabilities to achieve arbitrary code execution, resulting in full system compromise with changed scope.