CVE-2026-71385: ColdFusion | Incorrect Authorization (CWE-863)
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments where the ColdFusion administrative network zone is accessible to high-privileged users are exposed. The vulnerable component is restricted to an administrative network zone by default.
What does an attacker need to exploit this issue?
An attacker needs high privileges and network access to the affected administrative component. No user interaction is required.
What is the potential impact of successful exploitation?
A successful attacker could execute arbitrary code in the context of the current user. The vulnerability can affect confidentiality, integrity, and availability, with scope changed.