Adobe ColdFusion CVE-2026-48276

The required primitive is reachability of a ColdFusion file-upload pathway that fails to restrict dangerous file types (CWE-434) on versions 2025.9 / 2023.20 or earlier; the attacker must be able to write an interpretable script and then cause the server to execute it. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special configuration, privileges, or user interaction is stated to be needed - exploitation is remote and unauthenticated against affected builds. Limiting factors that reduce real-world risk: the ColdFusion instance must be network-reachable by the attacker (instances behind VPN/IP-allowlisting or with the admin/upload endpoints firewalled are harder to reach), and the PR:N assumption depends on the specific upload endpoint not enforcing authentication - verify against APSB26-68, since some ColdFusion functions are admin-gated.

Every CVSS 3.1 metric points to worst-case exploitability: AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no interaction), and S:C (scope change) with C:H/I:H/A:H, yielding the maximum 10.0. SSVC framing would read as automatable=yes and technical impact=total, which argues for an Act/immediate-remediation posture. However, EPSS is not provided in the input and the CVE is not in CISA KEV, so exploitation probability and active-exploitation status are currently UNKNOWN rather than confirmed - the score reflects potential, not observed, attacks. One caveat to verify: the description says code executes 'in the context of the current user,' which is consistent with running as the ColdFusion service account; the PR:N rating assumes the upload endpoint itself requires no authentication, which the description does not explicitly confirm - validate against Adobe APSB26-68. Net: treat as a genuine top-priority issue given the product's exploitation history, while acknowledging that real-world exploitation signals (EPSS, KEV, POC) are not yet present in the data.

An attacker reaches an internet-facing ColdFusion instance and sends a crafted HTTP request that uploads a malicious CFML script to a location the server will execute, then requests that file to trigger code execution as the ColdFusion service account - all without authentication prompts or user interaction. With a changed scope and full CIA impact, the attacker can pivot to host-level access and deploy a webshell. No public exploit is identified at time of analysis, but the attack is low-complexity and historically templated against ColdFusion.