What is the CVSS score of CVE-2026-48321?

CVE-2026-48321 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48321?

Adobe ColdFusion 2023 and 2025 contain a critical authorization bypass vulnerability (CVE-2026-48321, CVSS 9.3) allowing adjacent-network attackers to gain unauthorized read and write access to…

How to fix or mitigate CVE-2026-48321?

Within 24 hours, inventory all systems running Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) to quantify organizational exposure and identify internet-adjacent instances. Within 7 days, implement network-based compensating controls including firewall rules to restrict adjacent-network access to vulnerable instances, enable detailed authorization attempt logging, and isolate internet-exposed ColdFusion servers from sensitive systems through network segmentation. Within 30 days, establish monitoring for Adobe security advisories and patch releases, complete a business impact assessment of your ColdFusion deployments, and develop a formal remediation plan with target timelines for upgrading to patched versions once available.

Adobe ColdFusion CVE-2026-48321

EUVD-2026-44546 CRITICAL

Incorrect Authorization (CWE-863)

2026-07-14 psirt@adobe.com

GHSA-4qgq-8279-rrr7

Authentication Bypass Privilege Escalation Adobe Coldfusion

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

Adjacency-limited (AV:A) unauthenticated authorization bypass (PR:N, CWE-863) yielding high read/write impact with a scope change (S:C); no availability effect indicated (A:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 17:43 vuln.today

v3 (cvss_changed)

CVSS changed

Aug 05, 2026 - 17:37 NVD

10.0 (CRITICAL) 9.3 (CRITICAL)

Analysis Updated

Jul 15, 2026 - 18:16 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 18:07 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 18:07 NVD

9.3 (CRITICAL) 10.0 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 21:40 vuln.today

CVE Published

Jul 14, 2026 - 21:16 nvd

CRITICAL 9.3

DescriptionNVD

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Privilege escalation in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) allows an adjacent-network attacker to bypass authorization checks and gain unauthorized read and write access without any user interaction. Because the CVSS scope is changed, a successful exploit can affect resources beyond the vulnerable component. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the CWE-863 root cause and 9.3 base score make it a high-priority patch for internet-adjacent ColdFusion servers.

Technical ContextAI

ColdFusion is Adobe's commercial rapid-development application server that executes CFML and is commonly deployed to host web applications and internal enterprise portals. The flaw is classified as CWE-863 (Incorrect Authorization), meaning an authorization control is present but evaluates access incorrectly, letting an actor reach functionality or data they should not. Combined with the tag 'Authentication Bypass,' this points to a broken access-control path in the ColdFusion server/administration layer rather than a memory-safety bug. The CPE data confirms Adobe ColdFusion 2023 (base through Update 17 in NVD CPE, extended to Update 21 in the EUVD version data), and EUVD additionally lists the 2025 release line as affected.

RemediationAI

Apply the Adobe-released patches: upgrade ColdFusion 2023 to Update 22 and ColdFusion 2025 to Update 11, as directed in Adobe advisory APSB26-82 (https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html). These are the definitive fixes for the incorrect-authorization condition. Until patching is complete, reduce exposure by restricting network reachability to the ColdFusion server - since the attack vector is Adjacent, segment ColdFusion hosts onto isolated VLANs, block access to the ColdFusion Administrator and internal service ports from untrusted adjacent hosts, and place the application behind a reverse proxy or WAF that enforces authenticated access to administrative and privileged endpoints; the trade-off is potential disruption to legitimate management tools and integrations that rely on same-subnet access, so validate connectivity for monitoring and clustering after applying restrictions.