CVE-2026-47928
CriticalCVSS 9.6Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
Risk Assessment
The risk involves potential execution of malicious code by an attacker with access to the administrative zone, which could lead to system compromise.
Recommendation
It is recommended to upgrade to versions newer than 2025.8 and restrict access to the administrative zone.
Original NVD description (English source)
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.