CVE-2026-48284
CriticalCVSS 9.6Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, and the scope is changed.
Risk Assessment
The risk involves potential system compromise by an attacker without user interaction, leading to data theft, malware installation, or lateral movement within the network.
Recommendation
Apply the security update provided by Adobe for ColdFusion immediately. Until the patch is deployed, restrict access to the server and monitor for unusual activity.
Original NVD description (English source)
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.