CVE-2026-48325
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation does not require user interaction and the scope is changed.
Risk Assessment
An unauthenticated attacker could gain control of the system, leading to data theft, malware installation, or lateral movement within the network.
Recommendation
Apply the vendor-supplied patch immediately for the affected ColdFusion version and restrict server access to trusted networks only.
Original NVD description (English source)
ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.