CVE-2026-71386 is a Cross-site Scripting (XSS) vulnerability in Adobe ColdFusion 2025. It allows an attacker to execute arbitrary code within the context of the current user after the victim opens a malicious file. The affected component is typically limited to an administrative network zone, reducing exposure. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with attack vector requiring adjacent network access, low attack complexity, no privileges required, user interaction required, and changed scope. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could lead to arbitrary code execution with high impact on confidentiality, integrity, and availability of the affected system. Since the vulnerable component is restricted to an administrative network zone, the attack surface is limited. Exploitation requires user interaction, specifically opening a malicious file, which reduces the likelihood of automated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the administrative network zone and exercise caution with files opened by users in that zone. Monitor for updates from Adobe regarding patches or mitigations.