What is the CVSS score of CVE-2026-48318?

CVE-2026-48318 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 6.7%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48318?

Adobe ColdFusion contains a critical security flaw (CVE-2026-48318) that allows any authenticated user to bypass file access restrictions and read sensitive company files anywhere on the…

How to fix or mitigate CVE-2026-48318?

Within 24 hours, inventory all Adobe ColdFusion deployments, identify all accounts with ColdFusion authentication access, and audit recent file access logs for suspicious activity. Within 7 days, implement Web Application Firewall (WAF) rules to block path traversal patterns (../, encoded variants), enforce file system permissions restricting ColdFusion process access to essential directories only, and disable unnecessary user accounts. Within 30 days, establish monitoring for Adobe security advisory updates to APSB26-82 patch release, develop and test a patch deployment plan, and evaluate architectural alternatives such as containerization or network segmentation to limit ColdFusion file scope.

Adobe ColdFusion CVE-2026-48318

EUVD-2026-44551 CRITICAL

Path Traversal (CWE-22)

2026-07-14 psirt@adobe.com

GHSA-47x5-g7cj-cvgp

Path Traversal Adobe Coldfusion

9.9

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.7 HIGH

Description supports arbitrary file read only, so C:H but I:N/A:N; PR:L for low-privilege access, S:C because traversal reaches resources outside the app's security scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:41 vuln.today

CVE Published

Jul 14, 2026 - 21:16 nvd

CRITICAL 9.9

DescriptionCVE.org

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Path traversal in Adobe ColdFusion allows an authenticated remote attacker (PR:L) to read arbitrary files outside the intended web/application scope by manipulating pathname input, per Adobe advisory APSB26-82. The flaw carries a critical 9.9 CVSS with a changed scope, meaning a successful read can reach files belonging to other security contexts on the host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.

Technical ContextAI

ColdFusion is Adobe's commercial rapid-application-development platform and application server (CFML runtime) commonly deployed for web apps and behind enterprise web tiers. The root cause is CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): user-controllable input reaches a file-system operation without adequate canonicalization or allow-listing, so sequences such as '../' or absolute/UNC paths escape the intended directory. Because the CVSS scope is Changed (S:C), the vulnerable ColdFusion component can act on resources managed by a different security authority (e.g., OS files outside the application sandbox), amplifying impact. Exact affected builds are enumerated only in Adobe's bulletin; no CPE strings were supplied in this dataset.

RemediationAI

Apply the ColdFusion security update referenced in Adobe advisory APSB26-82 (https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html) as the primary fix; the exact patched build numbers are listed there and should be applied to every affected release train - no exact fix version was provided in this dataset to cite verbatim, so pull it from the advisory. Until patched, reduce exposure by restricting network access to the ColdFusion administrator and application endpoints via network ACLs or a WAF that blocks path-traversal patterns (../, encoded traversal, absolute/UNC paths), and run the ColdFusion service under a least-privilege OS account so an arbitrary-read primitive cannot reach sensitive system files; note that aggressive WAF rules can break legitimate file-handling features and least-privilege changes may require re-testing application file access. Because exploitation requires only low privileges (PR:L), also review and tighten application/administrator account provisioning and rotate any secrets that may reside in readable configuration files.