Adobe ColdFusion CVE-2026-48282

No special conditions - remote unauthenticated exploitation against default configurations of Adobe ColdFusion (CVSS AV:N/AC:L/PR:N/UI:N). The only meaningful prerequisite is network reachability of the ColdFusion HTTP service; internet-exposed instances are directly at risk. Limiting factors: instances not reachable from the attacker's network (e.g. behind strict firewalling, VPN-only access, or a filtering WAF) raise the bar, and a hardened/Lockdown-configured service account constrains the post-exploitation impact of arbitrary file writes, though the scope-change rating indicates impact can extend beyond ColdFusion's own security context.

All available signals point to maximum priority. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0 base score: network-reachable, low complexity, no privileges, no user interaction, scope change, and total compromise of confidentiality, integrity and availability. EPSS data was not provided, so exploitation probability cannot be quantified here. The vulnerability is NOT listed in CISA KEV based on the input, and no public exploit was identified at time of analysis, so this is not yet confirmed actively exploited. However, ColdFusion has a strong track record of rapid weaponization once details emerge, and the combination of unauthenticated network RCE with scope change means defenders should treat the absence of KEV/POC as a short-lived window, not a reason to delay. There are no conflicting signals: the description (unauthenticated, no user interaction, code execution) is fully consistent with the CVSS vector.

An attacker sends a crafted HTTP request to an internet-facing ColdFusion server containing path-traversal sequences in a parameter, escaping the intended directory to write a malicious script to a web-accessible or auto-executed location. The attacker then requests that file, causing the server to execute attacker-controlled code in the context of the ColdFusion service. No authentication or user interaction is required, and no public proof-of-concept has been identified at time of analysis.