AdobeCVE-2026-71387
Adobe ColdFusion: improper authorization
High8.8CVE-2026-71387 · Published Aug 11, 2026 · updated Aug 28, 2026
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| ColdFusion 2023 Product | <= 2023.0.22 | No fix yet |
| ColdFusion 2025 Product | <= 2025.0.11 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-863
More Adobe advisories
All Adobe| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 11 | Adobe Campaign Classic: improper authorization | Critical10.0 | No fix yet |
| Aug 11 | Adobe Commerce: improper authorization | Critical9.1 | No fix yet |
| Aug 11 | Adobe Lightroom Classic: improper authorization | High7.7 | No fix yet |
| Aug 11 | Adobe Lightroom Classic: path traversal | High8.6 | No fix yet |
| Aug 11 | Adobe Commerce: cross-site scripting | High8.7 | No fix yet |
| Aug 11 | Adobe Commerce: cross-site scripting | High7.7 | No fix yet |