What is the CVSS score of CVE-2026-48316?

CVE-2026-48316 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 1.4%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48316?

Adobe ColdFusion 2025.9, 2023.20, and earlier versions are vulnerable to unauthenticated remote code execution (CVSS 10.0) with no vendor patch available as of this analysis.

How to fix or mitigate CVE-2026-48316?

24 hours: Identify all ColdFusion deployments; isolate affected systems (2025.9, 2023.20, and earlier) from untrusted networks using firewall rules; block external access to default ColdFusion ports (8500, 8501, 80, 443). 7 days: Deploy Web Application Firewall (WAF) with input validation rules specific to ColdFusion RCE patterns; enable enhanced logging for all ColdFusion instances; obtain Adobe's patch timeline through official support channels; evaluate accelerated migration of non-critical systems to patched alternatives. 30 days: Apply Adobe vendor patch to all affected ColdFusion instances immediately upon release; perform incident response tabletop exercise; conduct forensic review of all ColdFusion logs for exploitation indicators.

Adobe ColdFusion CVE-2026-48316

EUVD-2026-41890 CRITICAL

Improper Input Validation (CWE-20)

2026-07-06 adobe

GHSA-7ppx-3g3p-7823

RCE Adobe Coldfusion

10.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

10.0 CRITICAL

Unauthenticated network RCE with no interaction gives AV:N/AC:L/PR:N/UI:N/S:C; code execution realistically enables full C/I/A impact, so I raise A to H versus the vendor's A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 17:08 vuln.today

CVE Published

Jul 06, 2026 - 16:13 cve.org

CRITICAL 10.0

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Remote code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases lets an unauthenticated network attacker run arbitrary code in the context of the current user via improper input validation (CWE-20), with no user interaction and a scope change to other components. Adobe rates this maximum severity (CVSS 10.0) and self-reported it; there is no public exploit identified at time of analysis and it is not yet listed in CISA KEV. Given ColdFusion's long history of mass-exploited RCE flaws, patching should be treated as urgent despite the current absence of a public PoC.

Technical ContextAI

Adobe ColdFusion is a commercial rapid application development platform built on the Java/JVM stack that executes CFML server-side templates and exposes numerous administrative and runtime services (Administrator console, AJAX/serialization endpoints, WDDX/JSON deserialization, file and scheduled-task handlers). The affected component is identified only by the broad CPE cpe:2.3:a:adobe:coldfusion:*, meaning all ColdFusion editions are in scope. The root cause is classed as CWE-20 (Improper Input Validation): attacker-controlled input reaches a sensitive operation without adequate sanitization, allowing it to alter program control flow into code execution. The CVSS scope-changed flag (S:C) indicates the flaw lets the attacker break out of the vulnerable ColdFusion component to affect resources beyond its security authority - historically consistent with ColdFusion deserialization/parsing bugs that pivot from a web-facing endpoint into OS- or JVM-level execution.

RemediationAI

Apply the security update from Adobe Security Bulletin APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html) as the primary fix; the input data does not include an exact fixed build number, so consult APSB26-68 for the precise patched update for your 2025 and 2023 trains and install it - do not rely on invented version numbers. Patch available per vendor advisory. Until patched, apply ColdFusion's documented lockdown/hardening guidance: restrict access to the ColdFusion Administrator and internal service ports (default 8500 and the AJP/CFML endpoints) to trusted management networks only, place the server behind a WAF or reverse proxy that filters anomalous serialized/CFML payloads, run ColdFusion under a least-privileged service account to limit the blast radius of 'current user' code execution, and disable or firewall any unused AJAX/serialization endpoints. Trade-offs: network restrictions and endpoint disabling can break remote administration and any legitimately exposed integration features, and WAF filtering may produce false positives against complex CFML traffic, so validate rules against application behavior before enforcing.