What is the CVSS score of CVE-2026-48322?

CVE-2026-48322 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-48322?

Within 24 hours, inventory all ColdFusion deployments and confirm which systems run version 2023 Update 21 or earlier, or version 2025 Update 10 or earlier. Within 7 days, isolate affected ColdFusion servers from critical network segments, restrict inbound access to authorized systems only, enable detailed logging of code execution events, and configure security alerts for suspicious activity patterns. Within 30 days, monitor Adobe PSIRT and security advisories daily for patch availability; prepare emergency change management procedures to deploy patched versions immediately upon vendor release.

Adobe ColdFusion CVE-2026-48322

EUVD-2026-44545 CRITICAL

Code Injection (CWE-94)

2026-07-14 psirt@adobe.com

GHSA-7j4p-hp5m-8r5p

RCE Code Injection Adobe Coldfusion

9.9

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable code injection with low complexity and no user interaction; requires a low-privileged authenticated session (PR:L), and code execution escaping the app context justifies scope change with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 15, 2026 - 18:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 18:07 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 18:07 NVD

9.6 (CRITICAL) 9.9 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 21:40 vuln.today

CVE Published

Jul 14, 2026 - 21:16 nvd

CRITICAL 9.6

DescriptionCVE.org

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Code injection (CWE-94) in Adobe ColdFusion 2023 (Update 21 and earlier) and ColdFusion 2025 (Update 10 and earlier) allows a low-privileged, network-adjacent attacker to execute arbitrary code in the context of the current user without any user interaction. Because the CVSS scope is changed, successful exploitation can extend impact beyond the vulnerable component to the underlying host. There is no public exploit identified at time of analysis and the EPSS probability is low (0.43%, 35th percentile), but the near-maximum CVSS of 9.9 and Adobe's own PSIRT reporting make this a high-priority patch.

Technical ContextAI

Adobe ColdFusion is a commercial rapid application development platform built on the JVM that compiles CFML templates into Java and runs them on a bundled application server (Tomcat/JEE). The affected CPEs confirm ColdFusion 2023 base through Update 17 (and per Adobe's EUVD data up to Update 21), with the parallel 2025 release train also impacted. The root cause is CWE-94, Improper Control of Generation of Code ('Code Injection'), meaning attacker-controlled input is incorporated into code that the ColdFusion engine subsequently evaluates or compiles - a class of flaw that in CFML environments typically leads directly to server-side code execution rather than mere data disclosure.

RemediationAI

Vendor-released patch: apply Adobe ColdFusion 2023 Update 22 or ColdFusion 2025 Update 11 as documented in Adobe APSB26-82 (https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html); this is the primary and definitive fix. Until patching completes, reduce exposure by restricting network access to the ColdFusion Administrator and any authenticated application endpoints to trusted management networks or VPN only, and enforce Adobe's ColdFusion lockdown guide (apply the secure profile, remove unused CFML tags/functions, and run the service under a least-privileged account) to blunt the scope-change impact - noting that lockdown hardening can break applications that rely on disabled tags, so test in staging first. Because exploitation requires low-privileged authentication, also rotate and tighten credentials for any accounts that can reach the vulnerable functionality.