Adobe ColdFusion CVE-2026-48321

Exploitation requires adjacent-network access (CVSS AV:A) to the ColdFusion server - the attacker must be on the same local/logical network segment (e.g., same LAN/VLAN, VPN, or an already-compromised adjacent host), not the open internet. Given PR:N and UI:N, no authentication and no user interaction are needed once the attacker has adjacency, and default configurations of the affected ColdFusion 2023 (≤Update 21) and 2025 (≤Update 10) builds are exposed to the authorization flaw. The primary limiting factors are the adjacency requirement and the absence of known public exploit code or automation (SSVC Automatable: no), which together narrow realistic exploitation to attackers who already have network proximity.

Signals conflict in an informative way. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, 9.3 Critical) indicates a low-complexity, unauthenticated attack with high confidentiality and integrity impact and a scope change - technically severe. However, the attack vector is Adjacent (AV:A), not Network, so exploitation requires the attacker to be on the same logical/adjacent network segment rather than the open internet, which meaningfully constrains reach. Corroborating this, EPSS is only 0.24% (15th percentile) and CISA SSVC rates Exploitation as 'none' and Automatable as 'no,' while still rating Technical Impact as 'total.' Net assessment: a genuinely high-impact authorization flaw whose real-world exploitation is currently gated by adjacency and lack of known automation/exploit code - prioritize patching for exposed or shared-network ColdFusion hosts, but immediate mass-exploitation pressure appears low today. Note the version discrepancy: NVD CPE stops at 2023 Update 17 while EUVD extends to Update 21 - verify exact affected range against Adobe APSB26-82.

An attacker who has gained a foothold on the same network segment as a ColdFusion 2023/2025 server sends crafted requests to a privileged endpoint that fails to correctly enforce authorization, obtaining read and write access to protected data or functionality without credentials or user interaction. Because scope is changed, the attacker can pivot to impact adjacent resources such as the underlying host or connected data stores. No public proof-of-concept has been identified, so exploitation would currently require original research.