CVE-2026-71384: adobe coldfusion Incorrect Authorization

Vulnerability summary

CVE-2026-71384 is a critical (CVSS 9.6) Incorrect Authorization vulnerability in adobe coldfusion. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.2% of scored vulnerabilities.

Timeline

1. 11-08-2026
   PublishedVulnerability first disclosed.
2. 27-08-2026
   Last modifiedVulnerability information updated.

Description

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.