CVE-2026-71386

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71386", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-08-06T09:00:49.999Z", "datePublished": "2026-08-11T16:30:57.984Z", "dateUpdated": "2026-08-27T22:34:00.619Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ColdFusion 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2025.0.11", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2025.0.12", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ColdFusion 2023", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2023.0.22", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2023.0.23", "versionType": "custom"}]}], "datePublic": "2026-08-11T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 8.9, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "ADJACENT_NETWORK", "modifiedAvailabilityImpact": "HIGH", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "CHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "CHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Cross-site Scripting (XSS) (CWE-79)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:34:00.619Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html"}], "source": {"discovery": "EXTERNAL"}, "title": "ColdFusion | Cross-site Scripting (XSS) (CWE-79)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T04:00:27.750878Z", "id": "CVE-2026-71386", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T14:48:55.476Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71386", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T04:00:27.750878Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T13:35:46.995Z"}}], "cna": {"title": "ColdFusion | Cross-site Scripting (XSS) (CWE-79)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "modifiedScope": "CHANGED", "temporalScore": 8.8, "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "HIGH", "availabilityImpact": "HIGH", "environmentalScore": 8.9, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "ADJACENT_NETWORK", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "ColdFusion 2025", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025.0.11"}, {"status": "unaffected", "version": "2025.0.12", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "ColdFusion 2023", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2023.0.22"}, {"status": "unaffected", "version": "2023.0.23", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-11T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross-site Scripting (XSS) (CWE-79)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:34:00.619Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71386", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:34:00.619Z", "dateReserved": "2026-08-06T09:00:49.999Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-08-11T16:30:57.984Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ColdFusion 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2025.0.11", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2025.0.12", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ColdFusion 2023", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2023.0.22", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2023.0.23", "versionType": "custom"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*", "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*", "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*", "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*", "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*", "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*", "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*", "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*", "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*", "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*", "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*", "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*", "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*", "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*", "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*", "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*", "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*", "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*", "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*", "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*", "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*", "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*", "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*", "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*", "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*", "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*", "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*", "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*", "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*", "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*", "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*", "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*", "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*", "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*", "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*", "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}], "id": "CVE-2026-71386", "lastModified": "2026-08-28T00:18:09.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 6.0, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71386", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T04:00:27.750878Z", "version": "2.0.3"}}]}, "published": "2026-08-11T17:19:13.723", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2023.0.22]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2023.0.23"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ColdFusion 2023", "source": "cna", "vendor": "Adobe"}, "product": "coldfusion_2023", "vendor": "adobe"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2025.0.11]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2025.0.12"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ColdFusion 2025", "source": "cna", "vendor": "Adobe"}, "product": "coldfusion_2025", "vendor": "adobe"}], "created": "2026-08-12T17:45:02.295983+00:00", "updated": "2026-09-24T23:45:07.561089+00:00", "vendors": ["adobe", "adobe$PRODUCT$coldfusion_2023", "adobe$PRODUCT$coldfusion_2025"]}