What is the CVSS score of CVE-2026-48283?

CVE-2026-48283 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48283?

Adobe ColdFusion versions 2025.9, 2023.20, and earlier contain a critical unauthenticated remote code execution vulnerability (CVE-2026-48283, CVSS 10.0) that allows attackers to upload and execute…

How to fix or mitigate CVE-2026-48283?

Within 24 hours: Inventory all ColdFusion instances and confirm installed versions (2025.9, 2023.20, earlier); restrict network access to upload endpoints and ColdFusion administrative interfaces using firewall rules; disable file upload functionality where operationally feasible. Within 7 days: Deploy Web Application Firewall rules to block file uploads with executable extensions (.cfm, .cfml, .cfc); implement enhanced logging and alerting on ColdFusion process execution and system access. Within 30 days: Monitor Adobe security advisories for patch release; apply vendor patch to all affected instances immediately upon availability.

Adobe ColdFusion CVE-2026-48283

EUVD-2026-40338 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-30 adobe

GHSA-cvwp-w8m7-5589

RCE Adobe File Upload Coldfusion

10.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Network-reachable unauthenticated upload-to-RCE with no user interaction and a changed scope yields full CIA impact, consistent with a 10.0 base.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 16:23 vuln.today

CVE Published

Jun 30, 2026 - 15:11 nvd

CRITICAL 10.0

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases stems from an unrestricted dangerous-file-type upload (CWE-434) that lets a remote attacker drop and execute a malicious payload, such as a CFM/CFML webshell, in the context of the running ColdFusion user. Rated CVSS 10.0 with a changed scope, it requires no user interaction and, per the provided vector, no authentication. No public exploit identified at time of analysis, though ColdFusion's history of weaponized upload bugs makes this a high-priority patch.

Technical ContextAI

Adobe ColdFusion is a commercial Java-based rapid web application development platform that compiles CFML templates and exposes administrative and application endpoints over HTTP/HTTPS, typically fronted by an embedded Tomcat/JRun connector. The CWE-434 root cause is an Unrestricted Upload of File with Dangerous Type: an upload handler fails to adequately validate file extension, content type, or destination path, allowing an attacker-controlled file with executable server-side semantics (e.g., a .cfm/.cfml or .jsp template) to be written into a web-accessible directory and then invoked. Because ColdFusion executes CFML it finds under its document roots, a successfully uploaded template runs as native application code rather than inert data. The single CPE (cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*) confirms the product itself is the affected component rather than a specific add-on.

RemediationAI

Apply the Adobe ColdFusion security update referenced in advisory APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html); upgrade beyond the affected 2025.9 and 2023.20 builds to the patched update levels Adobe lists there - the input does not provide the exact fixed build string, so confirm the target version directly from the advisory and treat APSB26-68 as the patch source (patch available per vendor advisory). Until patched, reduce exposure by applying ColdFusion's lockdown guidance: restrict or block external access to the ColdFusion Administrator and any file-upload endpoints at the web tier or firewall, run ColdFusion under a low-privileged service account to limit post-exploit impact, and enforce server-side validation/allowlisting of upload file types and write directories so uploaded files cannot land in CFML-executable paths (trade-off: tightening upload directories or blocking endpoints may break legitimate application features that rely on dynamic uploads, so test against application functionality before enforcing). Place a WAF rule to inspect multipart uploads for CFML/JSP payloads as an additional compensating control, recognizing WAF signatures can be bypassed and are not a substitute for the patch.