CVE-2026-71387: ColdFusion | Incorrect Authorization (CWE-863)

Published Aug 11, 2026

Updated

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction.

Affected Software

1 affected component

Adobe ColdFusion

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Ensure the ColdFusion deployment remains restricted to the administrative network zone (as it is by default) to limit exposure to the vulnerable component.

Event History

Aug 11, 2026

CVE Published

via MITRE·04:31 PM

Data Sourced

via MITRE·04:31 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-71387?

CVE-2026-71387 has a high severity rating of 8.8.

How can I fix CVE-2026-71387?

To fix CVE-2026-71387, apply the latest security updates provided by Adobe for ColdFusion.

What type of attack can CVE-2026-71387 facilitate?

CVE-2026-71387 facilitates arbitrary code execution in the context of the current user.

What is the risk associated with CVE-2026-71387?

CVE-2026-71387 carries a risk score of 79, indicating significant potential impact.

Who is affected by CVE-2026-71387?

CVE-2026-71387 affects users running vulnerable versions of ColdFusion within an administrative network zone.