What is the CVSS score of CVE-2026-48327?

CVE-2026-48327 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Coldfusion are affected by CVE-2026-48327?

A critical Adobe ColdFusion vulnerability (CVE-2026-48327, CVSS 9.0) enables low-privileged attackers on adjacent networks to bypass authorization controls and execute arbitrary code, creating a…

How to fix or mitigate CVE-2026-48327?

Within 24 hours, locate and inventory all ColdFusion deployments against Adobe advisory APSB26-82 to identify affected versions and network exposure; prioritize systems on adjacent networks or accessible from lower-trust segments for immediate protective action. Within 7 days, implement network segmentation restricting ColdFusion access to authenticated users only, disable non-essential ColdFusion modules and services, and enable enhanced logging and monitoring for suspicious authentication or authorization events on all ColdFusion systems. Within 30 days, prepare rapid deployment of Adobe's vendor-released patch by establishing a test-and-deploy process; conduct security assessments of all systems with ColdFusion access during the vulnerability window to detect potential unauthorized access or code execution.

Coldfusion CVE-2026-48327

EUVD-2026-44550 CRITICAL

Incorrect Authorization (CWE-863)

2026-07-14 psirt@adobe.com

GHSA-4qj7-x2fh-xjvq

Authentication Bypass RCE Adobe Coldfusion

9.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.0 CRITICAL

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:38 vuln.today

CVE Published

Jul 14, 2026 - 21:16 nvd

CRITICAL 9.0

DescriptionCVE.org

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion allows an attacker with low-privileged access on an adjacent network to bypass authorization controls (CWE-863) and run code in the context of the current user, with a scope change that lets the impact extend beyond the vulnerable component. Adobe PSIRT reported the flaw and published advisory APSB26-82; it is tagged as RCE and authentication bypass with a CVSS 3.1 base score of 9.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the incorrect-authorization-to-RCE pattern in ColdFusion has historically drawn rapid attacker interest.