CVE-2026-71384

Adobe ColdFusion contains an incorrect authorization flaw (CWE-863) that permits a security feature bypass, rated critical at CVSS 9.6. An attacker with access to the adjacent network — the vulnerable component sits in the administrative network zone by default — can trigger it with no privileges and no user interaction. Because the scope is 'changed,' the flaw lets the attacker cross a trust boundary, bypass security controls, and gain unauthorized read and write access, potentially causing an application denial-of-service. Any organization running an affected ColdFusion release is exposed, but default configurations that confine the component to the admin network zone limit how many are remotely reachable; the provided data did not specify affected version ranges. Exploitation status is currently quiet: no public proof-of-concept, not listed in CISA KEV, and EPSS estimates only a ~0.4% probability of exploitation within 30 days, though Adobe has shipped fixes as part of a recent ColdFusion patch release.

What to do: Apply Adobe's latest ColdFusion security update as soon as practical and check Adobe's bulletin for the specific affected versions, which were not included in this feed. Until patched, verify the vulnerable component is actually confined to the administrative network zone and enforce firewall/ACL rules so untrusted users on the adjacent network cannot reach it. Also confirm no ColdFusion administrative interfaces are exposed outside the admin zone and review logs for unexplained administrative-zone access or anomalous write activity.