What is the CVSS score of CVE-2026-48277?

CVE-2026-48277 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48277?

Adobe ColdFusion versions 2025.9 and 2023.20 and earlier are vulnerable to unauthenticated remote code execution with maximum-severity scoring (CVSS 10.0), enabling any internet-connected attacker to…

How to fix or mitigate CVE-2026-48277?

24 hours: Inventory all ColdFusion deployments (versions 2025.9 and 2023.20 and earlier); immediately restrict network access to trusted sources only via firewall/VPN; activate incident response procedures. 7 days: Isolate affected systems from production if operationally feasible; enable enhanced logging and monitoring for exploit attempts; subscribe to Adobe security advisories for patch timeline. 30 days: Deploy vendor-released patch immediately upon availability; plan migration to ColdFusion 2024.x or later if affected versions cannot be patched; document risk acceptance decisions with business stakeholders.

Adobe ColdFusion CVE-2026-48277

EUVD-2026-40345 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 adobe

GHSA-878m-wmqc-hqxm

RCE Adobe Coldfusion

10.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Description states remote arbitrary code execution with no user interaction and changed scope; improper input validation reachable over network implies AV:N/AC:L/PR:N and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 16:24 vuln.today

CVE Published

Jun 30, 2026 - 15:12 nvd

CRITICAL 10.0

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Remote code execution in Adobe ColdFusion (versions 2025.9, 2023.20 and earlier) lets a remote attacker run arbitrary code in the context of the current user with no authentication and no user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scored 10.0 with a changed scope. The root cause is improper input validation (CWE-20). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

ColdFusion is Adobe's commercial rapid web-application development platform and application server, built on the JVM and historically a frequent target for deserialization, file-handling, and input-parsing flaws that yield server-side code execution. The CPE cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:* confirms the affected product is the Adobe ColdFusion application itself (vendor-reported by Adobe). The vulnerability is classified CWE-20 (Improper Input Validation), meaning attacker-supplied input is not adequately validated before being processed, allowing it to influence execution flow; combined with the changed scope (S:C) in the CVSS vector, the impact crosses a trust/security boundary beyond the initially vulnerable component, which is typical of code execution that escapes the request-handling sandbox into the broader server context.

RemediationAI

Apply the Adobe security update referenced in advisory APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html) by upgrading to the fixed update that supersedes ColdFusion 2025.9 and 2023.20 on your respective branch; consult the advisory for the exact patched build number, as a specific fixed version was not included in the provided data (apply the next update above 2025.9 / 2023.20 as published by Adobe). Patch available per vendor advisory; the exact fix version is not confirmed in the input, so do not assume a version number - verify against APSB26-68. As compensating controls until patched, restrict network exposure of the ColdFusion server by placing it behind a WAF and firewall rules that deny access from untrusted networks to the ColdFusion ports and administrative endpoints (e.g., /CFIDE, the CF Admin, and any internet-facing application endpoints), and apply Adobe's ColdFusion Lockdown Guide hardening; the trade-off is that overly broad endpoint blocking can break legitimate application functionality, so test rules in staging and monitor logs for blocked legitimate requests.