CVE-2026-71386: ColdFusion | Cross-site Scripting (XSS) (CWE-79)
is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict the vulnerable ColdFusion component to an administrative network zone (it is restricted to this zone by default).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71386?
CVE-2026-71386 has a high severity rating of 8.8.
How do I fix CVE-2026-71386?
To fix CVE-2026-71386, update to the latest version of Adobe ColdFusion that addresses the vulnerability.
What impact does CVE-2026-71386 have on my system?
CVE-2026-71386 can lead to arbitrary code execution in the context of the current user, posing a significant risk.
Who is affected by CVE-2026-71386?
Users of Adobe ColdFusion, especially in administrative network zones, are affected by CVE-2026-71386.
What type of vulnerability is CVE-2026-71386?
CVE-2026-71386 is categorized as a Cross-site Scripting (XSS) vulnerability.