CVE-2026-71387

CVE-2026-71387 is an Adobe ColdFusion authorization bypass allowing arbitrary code execution without user interaction, scored at 8.8. The CVSS calculation treats an 'administrative network zone' as a meaningful compensating control. Treat that assumption with deep skepticism. ColdFusion has a documented genetic sequence of authorization bypasses stretching back over a decade—CVE-2010-2861, CVE-2013-0632, CVE-2014-0581 all share the same DNA: post-authentication code execution in a platform enterprises treat as too embedded to replace. Each iteration refined the attacker toolkit. Metasploit modules for ColdFusion authorization bypasses don't expire; the exploitation knowledge base is cumulative, which means the probability floor for these CVEs has effectively risen regardless of what the EPSS 0.00271 suggests. The network zone restriction compounds two failures simultaneously. First, zones decay—organizations that deployed ColdFusion-in-a-zone under competent security leadership have since experienced mergers, staff turnover, and budget contractions that degraded actual enforcement. The control exists in topology diagrams and security baselines long after the enforcement rationale has been forgotten. This is ghost architecture: zone constraints that persist in documentation but not in active validation. Second, and more critically, the zone limits who can reach the vulnerability but does not constrain what a compromised ColdFusion server can reach outward. ColdFusion instances typically connect to databases, file systems, and authentication backends serving the entire enterprise. Code execution on ColdFusion often means SYSTEM or root privileges—that's not just the zone, that's the network neighborhood. The practical remediation posture splits into two tracks. For prevention: map your ColdFusion footprint and validate whether the network boundary actually exists in traffic logs, not just architecture diagrams. If you cannot confirm active enforcement, treat this as internet-adjacent exposure. For detection and containment: prioritize detection rules for ColdFusion process spawning unusual commands, lateral movement through its integration points, and credential access from the ColdFusion host. The blast radius if the zone fails is enormous—far exceeding what the CVSS 8.8 captures. The EPSS probability is genuinely lower than the severity implies, but that gap is narrower than it appears. The denominator matters: organizations still running ColdFusion are not running cutting-edge security programs. Exploitation tooling is mature, defense sophistication in ColdFusion-heavy environments is often low, and the institutional response to similar CVEs has consistently been to defer while assuming the zone holds. History suggests many of them got owned.

Reviewed through automated stages and approved by a human before publication.