Adobe ColdFusion CVE-2026-71387

The attacker must have network adjacency to the ColdFusion administrative network zone - this is the primary and most significant limiting condition. By default, ColdFusion restricts its Administrator interface to an administrative network zone, meaning general internet attackers are blocked at the network perimeter under a standard deployment. However, environments where the admin interface is reachable from broad internal segments, flat cloud VPCs, or guest/VPN networks are effectively exposed. No authentication is required (PR:N in CVSS vector) - the authorization bypass allows exploitation without any credential, making the attack trivially executable once network access is achieved. No user interaction is required. Both ColdFusion 2023 and ColdFusion 2025 are affected at all current patch levels. Exploitation is NOT limited to a specific operating system or deployment mode beyond the network adjacency requirement.

CVSS 8.8 accurately reflects the severity given full C/H/I/H/A/H impact and zero authentication requirement, but the Adjacent attack vector (AV:A) is the critical moderating signal: attackers cannot reach the vulnerable endpoint from the open internet under default ColdFusion configurations. Real-world risk is therefore concentrated in organizations where the ColdFusion admin interface is reachable from general internal network segments, VPN users, or cloud environments with flat networking - all common in practice. The PR:N rating combined with CWE-863 strongly implies the authorization bypass entirely circumvents credential checks rather than requiring low-level access, which aligns with the 'Authentication Bypass' tag. No EPSS data was provided; however, the absence of a KEV listing and public POC suggests exploitation is not currently widespread. ColdFusion has a history of being actively targeted (multiple prior KEV entries for ColdFusion RCE chains), so patching velocity should be treated as urgent. There is no conflict between the CVSS vector and the description - both consistently indicate an adjacent-network, no-auth, no-interaction path to RCE.

An attacker with access to the internal network segment hosting the ColdFusion administrative interface - whether via direct LAN access, compromised internal host, or VPN - sends a crafted HTTP request to the ColdFusion Administrator that bypasses authorization checks without supplying credentials. The application incorrectly grants the request elevated privileges, allowing the attacker to invoke administrative functionality and achieve arbitrary code execution running as the ColdFusion service account. No public proof-of-concept exploit code has been identified at time of analysis.