CVE-2026-48327
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
An incorrect authorization vulnerability in ColdFusion allows remote arbitrary code execution in the context of the current user without requiring user interaction. This leads to privilege escalation and a changed security scope.
Risk Assessment
An attacker can remotely execute arbitrary code on the ColdFusion server, potentially gaining control over the application and accessing sensitive data.
Recommendation
Immediately apply the security patch provided by Adobe for ColdFusion. Restrict server access to trusted networks only and monitor logs for suspicious activity.
Original NVD description (English source)
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.