What is the CVSS score of CVE-2026-48285?

CVE-2026-48285 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48285?

Adobe ColdFusion versions 2023.20, 2025.9, and all earlier releases contain an unauthenticated Server-Side Request Forgery vulnerability (CVSS 8.6) enabling remote attackers to bypass security…

How to fix or mitigate CVE-2026-48285?

Within 24 hours: Inventory all ColdFusion deployments and determine exposure to untrusted networks; isolate critical instances if possible. Within 7 days: Implement network segmentation to restrict ColdFusion outbound requests to only legitimate internal destinations; deploy WAF rules to block suspicious HTTP requests from ColdFusion; enable request logging to detect SSRF attempts. Within 30 days: Monitor Adobe security advisories for patch availability; plan ColdFusion version upgrade to patched release once available; conduct internal systems audit to identify data accessible via SSRF.

Adobe ColdFusion CVE-2026-48285

EUVD-2026-40344 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-30 adobe

GHSA-45mc-x72w-r769

SSRF Adobe Coldfusion

8.6

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Remote, low-complexity, unauthenticated SSRF (AV:N/AC:L/PR:N/UI:N); changed scope reflects reaching other systems, with high confidentiality read access and no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 16:23 vuln.today

CVE Published

Jun 30, 2026 - 15:12 nvd

HIGH 8.6

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Server-Side Request Forgery in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets a remote, unauthenticated attacker coerce the server into issuing crafted requests, bypassing intended security controls to gain unauthorized read access to otherwise protected resources. Because the CVSS scope is changed (S:C) and confidentiality impact is High, the attacker can reach internal systems or restricted endpoints beyond ColdFusion's own boundary without any user interaction. No public exploit identified at time of analysis, and this CVE is not on CISA KEV.

Technical ContextAI

ColdFusion is Adobe's commercial rapid-application-development platform and Java-based application server used to build and host web applications, frequently exposed directly to the internet. The flaw maps to CWE-918 (Server-Side Request Forgery): the application accepts attacker-influenced input that determines the destination of an outbound request, but fails to validate or restrict that destination, so the trusted server is tricked into fetching resources on the attacker's behalf. The CPE cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:* covers the ColdFusion application across affected version trains. The changed scope (S:C) in the CVSS vector reflects the defining SSRF characteristic - the vulnerable component (ColdFusion) is leveraged to impact a different security authority, such as internal services, cloud metadata endpoints, or filtered network segments the attacker could not otherwise reach.

RemediationAI

Apply the ColdFusion update referenced in Adobe Security Bulletin APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html); Patch available per vendor advisory - upgrade beyond the affected 2025.9 and 2023.20 builds to the patched releases Adobe lists in that bulletin (exact fixed build not provided in this input, so confirm the version directly from APSB26-68). If patching cannot be done immediately, reduce SSRF reachability with compensating controls: place ColdFusion behind an egress-filtering proxy or firewall that denies outbound requests to internal/RFC1918 ranges, loopback, link-local and cloud metadata addresses (169.254.169.254), which blunts the most damaging SSRF targets but can break legitimate outbound integrations the application relies on; restrict and authenticate access to any ColdFusion features or endpoints that accept user-supplied URLs or remote-fetch parameters, accepting that this may disrupt workflows depending on those features; and keep the ColdFusion administrator and internal services off the public internet. These mitigations narrow exposure but do not remove the underlying flaw, so treat them as temporary until the vendor update is installed.