What is the CVSS score of CVE-2026-48276?

CVE-2026-48276 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48276?

Adobe ColdFusion versions 2025.9, 2023.20, and earlier contain a critical unauthenticated remote code execution vulnerability (CVSS 10.0) that could enable complete application compromise and data…

Is there a public PoC exploit available for CVE-2026-48276?

Yes, a public proof-of-concept exploit is available for CVE-2026-48276. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-48276?

Within 24 hours: Inventory all ColdFusion instances and affected versions; identify and restrict network access to external-facing deployments. Within 7 days: Implement compensating controls (network segmentation, Web Application Firewall rules to block executable uploads, enhanced logging); evaluate temporary service shutdown of non-critical instances if operations permit. Within 30 days: Continuously monitor Adobe security advisories for patch release; apply immediately upon availability and upgrade to patched version.

Adobe ColdFusion CVE-2026-48276

EUVD-2026-40340 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-30 adobe

GHSA-fvm7-fwcr-42hp

RCE File Upload Coldfusion

10.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Remote unauthenticated file upload yielding code execution with no interaction; scope changes as code escapes the app into the host, so full C/I/A High.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 16:25 vuln.today

CVE Published

Jun 30, 2026 - 15:11 nvd

CRITICAL 10.0

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote attacker upload a file of a dangerous type (e.g., a CFML/JSP payload) and execute it in the context of the current user, with no user interaction required. The CVSS 3.1 base score is the maximum 10.0 with a changed scope, reflecting that successful exploitation breaches the ColdFusion process boundary. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but ColdFusion's history of weaponized file-upload/RCE bugs makes this a high-priority patch.

Technical ContextAI

Adobe ColdFusion is a commercial application server and CFML (ColdFusion Markup Language) runtime widely used to build dynamic web applications, typically fronted by IIS or Apache and reachable over HTTP/HTTPS. The flaw is classified as CWE-434, Unrestricted Upload of File with Dangerous Type: the platform accepts an uploaded file without adequately validating its type, extension, or content, allowing an executable server-side script to be written into a location the engine will subsequently parse and run. Because CFML templates execute server-side, an uploaded .cfm/.cfml (or otherwise interpretable) file becomes attacker-controlled code running inside the ColdFusion JVM. The single CPE provided, cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*, is a wildcard that does not pin specific versions, so version scoping must come from the description (2025.9, 2023.20 and earlier).

RemediationAI

Apply the security update referenced in Adobe advisory APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html): upgrade to the patched update level above ColdFusion 2025.9 and 2023.20 - Patch available per vendor advisory, exact patched build numbers not enumerated in the input, so confirm the version directly from APSB26-68 before deploying. As compensating controls until patched, restrict or disable any unauthenticated file-upload endpoints, enforce a strict server-side allowlist of permitted file types and reject executable extensions (.cfm/.cfml/.jsp), and ensure upload directories are stored outside any web-accessible/executable path so written files cannot be invoked as templates (trade-off: may break legitimate upload features). Place the ColdFusion administrator and known sensitive endpoints behind network ACLs or a WAF rule blocking multipart uploads to unexpected paths, run the ColdFusion service under a least-privilege account to limit blast radius, and apply Adobe's lockdown guide; these reduce exposure but are not a substitute for the official patch.