What is the CVSS score of CVE-2026-48325?

CVE-2026-48325 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Coldfusion are affected by CVE-2026-48325?

Adobe ColdFusion contains a critical authentication bypass vulnerability (CVE-2026-48325, CVSS 9.3) enabling unauthenticated remote code execution with scope change implications.

How to fix or mitigate CVE-2026-48325?

Within 24 hours, identify all Adobe ColdFusion instances across your infrastructure and document versions; immediately implement network segmentation to restrict access to affected systems from untrusted networks; deploy emergency WAF rules or firewall policies blocking access to the vulnerable function. Within 7 days, obtain detailed technical guidance from Adobe PSIRT regarding advisory APSB26-82 and any available workarounds; enable comprehensive logging and real-time alerting on all ColdFusion instances; develop a prioritized remediation roadmap. Within 30 days, establish weekly monitoring of Adobe security bulletins to track patch availability; evaluate business continuity options including application migration or temporary service suspension if adequate protections cannot be implemented; conduct forensic analysis for any indicators of compromise or exploitation attempts.

Coldfusion CVE-2026-48325

EUVD-2026-44542 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-14 psirt@adobe.com

GHSA-85wf-cvx8-h26j

Authentication Bypass RCE Coldfusion

9.3

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.3 CRITICAL

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:38 vuln.today

CVE Published

Jul 14, 2026 - 21:16 nvd

CRITICAL 9.3

DescriptionCVE.org

ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Missing authentication in Adobe ColdFusion allows an unauthenticated attacker on an adjacent network to trigger arbitrary code execution in the context of the current user, without any user interaction. The flaw (CWE-306) bypasses authentication on a critical function and carries a scope change, meaning the impact reaches beyond the vulnerable component. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, identify all Adobe ColdFusion instances across your infrastructure and document versions; immediately implement network segmentation to restrict access to affected systems from untrusted networks; deploy emergency WAF rules or firewall policies blocking access to the vulnerable function. …

Threat intelligence, references, and detailed analysis are available after sign-in.