CVE-2026-48316
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
A vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier is caused by improper input validation, potentially leading to remote arbitrary code execution in the context of the current user. Exploitation does not require user interaction and the scope is changed.
Risk Assessment
The risk for the organization includes the possibility of an attacker gaining control over the system without user interaction, which could lead to data theft, malware installation, or further propagation of the attack within the network.
Recommendation
It is recommended to immediately update ColdFusion to the latest available version that fixes this vulnerability. Additionally, restrict access to the ColdFusion server to trusted networks only and apply WAF rules to block suspicious requests.
Original NVD description (English source)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.