What is the CVSS score of CVE-2026-48307?

CVE-2026-48307 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48307?

Adobe ColdFusion 2025.9 and 2023.20 or earlier contain a reflected cross-site scripting vulnerability (CVE-2026-48307) allowing code execution in administrator sessions when an admin opens a…

How to fix or mitigate CVE-2026-48307?

Within 24 hours: audit all ColdFusion instances to identify versions 2025.9, 2023.20, or earlier; document administrator user accounts and access patterns. Within 7 days: enforce multi-factor authentication on admin accounts; restrict admin console network access to approved corporate IP ranges; implement email security controls and mandatory administrator security awareness training on malicious links. Within 30 days: monitor Adobe security advisories for patch availability; plan upgrade to unaffected version 2025.10 or later, or evaluate alternative solutions.

Adobe ColdFusion CVE-2026-48307

EUVD-2026-40342 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-30 adobe

GHSA-66r6-8679-j6vq

XSS RCE Adobe Coldfusion

8.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Link-based reflected XSS is realistically network-delivered (AV:N over Adobe's AV:A); UI:R for the click, scope changed into the browser context, high confidentiality (session/token theft) but limited integrity and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 16:22 vuln.today

CVE Published

Jun 30, 2026 - 15:11 nvd

HIGH 8.8

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious link. Scope is changed.

AnalysisAI

Reflected Cross-Site Scripting in Adobe ColdFusion 2025.9, 2023.20 and earlier lets an attacker craft a malicious link that, when opened by a victim, injects and executes attacker-controlled script in the victim's browser session, with Adobe characterizing the impact as potential arbitrary code execution in the context of the current user. Because the CVSS scope is changed and confidentiality, integrity and availability impacts are all rated High, a successful attack against an authenticated ColdFusion administrator could compromise the management interface. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

ColdFusion is Adobe's commercial rapid web-application development platform and Java-based application server, commonly used to build and host dynamic web applications and exposing browser-accessible administrative and application endpoints. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected variant where untrusted request input is echoed back into an HTTP response without proper output encoding, so the browser parses attacker-supplied markup as executable script. The affected component per CPE is cpe:2.3:a:adobe:coldfusion (all versions through the listed builds); Adobe's tagging of this as RCE reflects that script execution within a privileged ColdFusion administrative/user context can be escalated toward broader server-side actions, not that the XSS itself yields native server code execution.

RemediationAI

Apply the security update referenced in Adobe Security Bulletin APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html); upgrade ColdFusion 2025 beyond update 9 and ColdFusion 2023 beyond update 20 to the patched builds Adobe specifies in that advisory, as a patch is available per the vendor advisory and an exact fixed version should be taken directly from it rather than assumed. Until patching, restrict network exposure of the ColdFusion Administrator and any affected endpoints to trusted management networks or VPN only, which reduces who can be lured into clicking a malicious link but does not protect users with legitimate access; deploy a WAF rule or reverse-proxy filter to strip or encode reflected script in the vulnerable parameter, accepting possible false positives on legitimate input; and enforce a restrictive Content-Security-Policy on ColdFusion responses to inhibit inline script execution, noting it may break legacy inline scripts in custom apps. User-awareness measures against clicking untrusted ColdFusion links provide partial, non-technical mitigation only.