What is the CVSS score of CVE-2026-71386?

CVE-2026-71386 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Adobe ColdFusion are affected by CVE-2026-71386?

A cross-site scripting vulnerability in Adobe ColdFusion 2023 and 2025 (CVSS 8.8) enables remote code execution when administrative users interact with malicious files, putting administrative access…

How to fix or mitigate CVE-2026-71386?

Within 24 hours: Identify and audit all ColdFusion 2023 and 2025 instances; restrict administrative interface access to essential personnel and disable external or VPN access until patched. Within 7 days: enforce network segmentation to isolate ColdFusion administrative systems from production environments and implement file upload restrictions on vulnerable components. Within 30 days: monitor Adobe security advisory APSB26-90 for patch availability; upon release, test in staging within 48 hours and deploy production fix within one week.

Adobe ColdFusion CVE-2026-71386

EUVD-2026-56538 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-11 adobe

GHSA-gvhj-hqg3-q4qg

XSS RCE Adobe Coldfusion 2025 Coldfusion 2023

8.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

AV:A confirmed by default admin zone restriction; S:C reflects XSS-to-RCE scope crossing; full CIA from arbitrary code execution.

3.1 AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 17:23 vuln.today

CVE Published

Aug 11, 2026 - 16:30 nvd

HIGH 8.8

DescriptionCVE.org

is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

AnalysisAI

Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.

Technical ContextAI

Adobe ColdFusion is a commercial Java-based application server and rapid web development platform used primarily in enterprise environments. The vulnerability affects ColdFusion 2023 (CPE: cpe:2.3:a:adobe:coldfusion_2023:*:*:*:*:*:*:*:*) and ColdFusion 2025 (CPE: cpe:2.3:a:adobe:coldfusion_2025:*:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization of user-supplied input before it is rendered in the browser, enabling script injection. In ColdFusion's administrative context, XSS is particularly dangerous because the admin interface has direct access to server-side CFML execution capabilities, file system operations, and database connectivity - meaning injected client-side scripts can be leveraged to trigger server-side code execution, explaining the scope change (S:C) in the CVSS vector.

RemediationAI

Apply the patch detailed in Adobe Security Bulletin APSB26-90 (https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html) - this is the primary and definitive fix; exact patched version numbers must be confirmed from the bulletin directly as they are not independently verified in available data. As compensating controls pending patching: ensure the ColdFusion administrative interface remains strictly confined to the administrative network zone (the default configuration) and enforce VPN or jump-host requirements for any administrative access, which preserves the AV:A boundary that limits attacker reachability. Restrict or disable file upload and file preview functionality within the ColdFusion Administrator where not operationally required, since exploitation depends on a victim opening a malicious file - removing that interaction pathway eliminates the UI:R trigger condition. Implement Content Security Policy (CSP) headers on the ColdFusion admin interface as a defense-in-depth layer to constrain XSS payload execution scope.