CVE-2026-48332
HighCVSS 7.7Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
An SSRF vulnerability in ColdFusion allows a low-privileged attacker to bypass security measures and gain unauthorized read access. Exploitation does not require user interaction and the scope is changed.
Risk Assessment
An attacker can access internal network resources, leading to data leakage and potential compromise of system integrity.
Recommendation
Apply the vendor-supplied patch immediately and restrict access to the ColdFusion server to trusted networks only.
Original NVD description (English source)
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.