CVE-2026-48322
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
ColdFusion is affected by a Code Injection vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation does not require user interaction and the scope is changed.
Risk Assessment
The risk is that an unauthenticated attacker could take control of the ColdFusion server, leading to data theft, malware installation, or further attacks on the infrastructure.
Recommendation
Apply the security patch provided by the vendor for the affected ColdFusion version immediately. Until patched, restrict access to the server and deploy WAF rules to block suspicious requests.
Original NVD description (English source)
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.