Adobe ColdFusion CVE-2026-48313

No special conditions - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against network-reachable Adobe ColdFusion 2025.9, 2023.20, or earlier, with no user interaction required per the description. The practical limiting factor is reachability: the vulnerable ColdFusion HTTP endpoint must be accessible to the attacker, so servers behind segmentation, VPN, or WAF traversal filtering are harder to reach, and the impact is bounded to filesystem read plus limited write (C:H/I:L/A:N) rather than guaranteed code execution. The exact vulnerable parameter or feature is not enumerated in the available data and should be confirmed from Adobe APSB26-68.

Signals are partially complete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, 9.3 critical) describes a network-reachable, low-complexity, unauthenticated attack with a scope change and high confidentiality impact - a strong priority on paper. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so probabilistic and observed-exploitation signals cannot be cross-referenced; the assessment rests on CVSS plus the description. The C:H/I:L/A:N profile correctly reflects a read-centric primitive with only limited write and no availability impact, so this is data-exposure-led rather than direct RCE - though file read of ColdFusion secrets historically chains into fuller compromise. ColdFusion is a recurring exploitation target, so despite the absence of an EPSS/KEV signal here, treat this as a high real-world priority and verify exploitation telemetry against the vendor advisory.

An attacker sends a crafted HTTP request to an internet-facing ColdFusion server containing a path-traversal sequence in a vulnerable parameter, causing the server to resolve and return a file outside the web root such as a datasource configuration or credential file. Using the harvested secrets - and the limited write capability - the attacker pivots toward administrative access or further compromise. No public exploit is identified at time of analysis, so this reflects the described primitive rather than an observed campaign.