What is the CVSS score of CVE-2026-48319?

CVE-2026-48319 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48319?

Adobe ColdFusion 2023 and 2025 contain a critical path traversal vulnerability enabling authenticated, high-privilege users to execute arbitrary system code beyond the application's intended scope.

How to fix or mitigate CVE-2026-48319?

Within 24 hours, inventory all systems running Adobe ColdFusion 2023 (through Update 21) or ColdFusion 2025 (through Update 10) and review high-privilege administrator access logs for anomalies. Within 7 days, implement enhanced filesystem access controls to restrict ColdFusion directory traversal capabilities; enable detailed logging of all administrative actions; and enforce credential rotation for privileged ColdFusion accounts. Within 30 days, establish a vendor-patch monitoring process, document all interim compensating controls and their residual risk, and begin evaluating architectural alternatives or version upgrades once patches are released.

Adobe ColdFusion CVE-2026-48319

EUVD-2026-44547 CRITICAL

Path Traversal (CWE-22)

2026-07-14 psirt@adobe.com

GHSA-m5vp-7jc3-c6vp

RCE Path Traversal Adobe Coldfusion

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Network-reachable path traversal to code execution needs an elevated authenticated account (PR:H), no user interaction, low complexity, with total impact and scope change beyond the component.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 19:33 vuln.today

v3 (cvss_changed)

CVSS changed

Jul 29, 2026 - 19:22 NVD

9.9 (CRITICAL) 9.1 (CRITICAL)

Analysis Updated

Jul 15, 2026 - 18:20 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 18:07 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 18:07 NVD

9.1 (CRITICAL) 9.9 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 21:41 vuln.today

CVE Published

Jul 14, 2026 - 21:16 nvd

CRITICAL 9.1

DescriptionNVD

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) arises from a path traversal weakness that lets an authenticated attacker with high privileges escape a restricted directory and run code in the context of the current user. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, and CISA's SSVC rates the technical impact as total. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.93%), indicating no evidence of widespread automated exploitation yet.

Technical ContextAI

ColdFusion is Adobe's commercial rapid-application-development platform and Java-based application server used to build and run CFML web applications, typically fronted by its own built-in web server or integrated with IIS/Apache. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, 'Path Traversal'): user-controlled input containing directory-traversal sequences (e.g. ../) is not properly canonicalized or constrained, allowing access to files and paths outside an intended restricted directory. In ColdFusion, such a traversal primitive can be chained into code execution because the platform interprets and executes CFML/Java content from writable or reachable locations, turning a file-path flaw into arbitrary code execution in the context of the running ColdFusion process/user. The affected code is present across the ColdFusion 2023 update train (CPE data explicitly enumerates base through Update 17, and EUVD extends the affected range to Update 21) and the ColdFusion 2025 line through Update 10.

RemediationAI

Vendor-released patch: upgrade ColdFusion 2023 to Update 22 and ColdFusion 2025 to Update 11, per Adobe security bulletin APSB26-82 (https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html), which is the primary and recommended fix. Until patches can be applied, reduce exposure by restricting network access to the ColdFusion Administrator and any privileged CFML endpoints to trusted management networks or VPN only (trade-off: may disrupt remote administration workflows), enforcing least privilege so the ColdFusion service account cannot write to or execute from web-reachable directories (trade-off: may require testing of application file-write features), and applying Adobe's documented ColdFusion lockdown guidance to tighten file-system and sandbox permissions. Because exploitation requires high privileges, also review and rotate credentials for any accounts that could satisfy the PR:H precondition and audit for unexpected privileged access. Do not treat workarounds as a substitute for the Update 22 / Update 11 patches.