What is the CVSS score of CVE-2026-48281?

CVE-2026-48281 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48281?

Organizations running Adobe ColdFusion 2025.9 and 2023.20 face immediate risk of remote code execution by unauthenticated attackers, with no vendor patch currently available.

How to fix or mitigate CVE-2026-48281?

24 hours: Identify all ColdFusion 2025.9 and 2023.20 instances in your environment and immediately restrict their internet-facing access; contact Adobe support for patch timeline. 7 days: Implement network segmentation isolating affected ColdFusion instances from untrusted networks; deploy Web Application Firewall rules to block exploitation attempts; restrict administrative access to authenticated users only. 30 days: Apply vendor patch immediately upon release; if Adobe provides no patch timeline within 30 days, execute emergency migration to alternative application server or patched ColdFusion version.

Adobe ColdFusion CVE-2026-48281

EUVD-2026-40346 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 adobe

GHSA-39jm-g7jr-7w2j

RCE Adobe Coldfusion

10.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network RCE with no user interaction (AV:N/AC:L/PR:N/UI:N), full triad impact, and scope change to the host justify S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 16:24 vuln.today

CVE Published

Jun 30, 2026 - 15:12 nvd

CRITICAL 10.0

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and earlier lets a remote attacker run code in the context of the current user with no authentication and no user interaction. The flaw stems from improper input validation (CWE-20) and carries a maximum CVSS of 10.0 with a changed scope, meaning impact can extend beyond the vulnerable component. No public exploit identified at time of analysis, but ColdFusion's history of weaponized RCE bugs makes this a high-priority patch.

Technical ContextAI

Adobe ColdFusion is a commercial rapid-development application server (CFML runtime) historically used for enterprise web applications, often internet-facing. The root cause is classed as CWE-20, Improper Input Validation: attacker-supplied input reaches a sensitive operation without adequate sanitization, allowing it to be interpreted or executed rather than treated as inert data, which culminates in arbitrary code execution. The single CPE provided, cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*, identifies all versions of the Adobe ColdFusion application without further edition constraints; the description narrows the affected builds to the 2025 and 2023 release trains. The CVSS scope change (S:C) indicates the vulnerable ColdFusion component can compromise resources beyond its own security authority, consistent with code execution that breaks out of the application sandbox into the host context.

RemediationAI

Apply the fixed ColdFusion releases distributed by Adobe in advisory APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html); Patch available per vendor advisory, though the exact patched build numbers were not included in the provided data and should be read directly from that advisory before deployment. As compensating controls until patching completes: restrict network access to the ColdFusion administrator and CFML endpoints to trusted management IPs via firewall or reverse-proxy ACLs (trade-off: may break legitimate remote administration and integrations), place the server behind a WAF with rules for ColdFusion exploit patterns (trade-off: signature gaps can still be bypassed), enforce ColdFusion's secure-profile lockdown and remove or disable unused components and example applications (trade-off: some legacy app features may stop working), and run the ColdFusion service under a least-privileged account to limit blast radius of code execution in the current-user context (trade-off: may require permission retuning for file and datasource access).