What is the CVSS score of CVE-2026-48363?

CVE-2026-48363 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48363?

Adobe ColdFusion deployments (versions 2025.9, 2023.20, and earlier) face a critical code execution vulnerability triggered when users open malicious files, with no security patch currently…

How to fix or mitigate CVE-2026-48363?

Within 24 hours: Inventory all Adobe ColdFusion installations and versions in production, identify systems that process externally-sourced files, and issue guidance restricting file opening from untrusted external sources. Within 7 days: Deploy compensating controls including reduction of ColdFusion service account privileges to least-privilege, disabling DLL preloading mechanisms in system configuration, implementation of application whitelisting policies, and deployment of security awareness training on file validation and safe file handling. Within 30 days: Monitor Adobe security advisories for patch availability, prepare a tested deployment plan for immediate patch application once released, and evaluate sandboxing or segmentation solutions for ColdFusion systems handling external content.

Adobe ColdFusion CVE-2026-48363

HIGH

Uncontrolled Search Path Element (CWE-427)

2026-07-13 adobe

RCE Adobe Coldfusion

8.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.6 HIGH

Local delivery (AV:L) with a victim opening a malicious file needing no attacker privileges (PR:N, UI:R); untrusted library load yields full C/I/A impact with changed scope (S:C).

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:00 vuln.today

CVE Published

Jul 13, 2026 - 20:03 cve.org

HIGH 8.2

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and all earlier releases arises from an Uncontrolled Search Path Element weakness that lets attacker-controlled files or libraries be loaded when a victim opens a malicious file, running code in the context of the current user. The bug carries a scope change (S:C), meaning execution can affect resources beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so real-world risk currently hinges on social-engineering a local user into opening a crafted file.

Technical ContextAI

The root cause is CWE-427 (Uncontrolled Search Path Element), the class of flaw where an application resolves an executable, DLL, shared library, or other dependency using a search path that includes attacker-writable or attacker-supplied locations. In practice this typically manifests as DLL/library hijacking or planting a malicious component alongside a document the application processes; when ColdFusion (or an associated tool/handler) opens the file, it loads the untrusted element instead of the legitimate one and executes attacker code. The affected component is the Adobe ColdFusion application server (CPE cpe:2.3:a:adobe:coldfusion), a Java-based platform for building and running CFML web applications, which explains why code runs with the privileges of the current user rather than a network service.

RemediationAI

Apply the Adobe security update referenced in advisory APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html) as the primary fix; upgrade past the affected 2025.9 and 2023.20 builds to the vendor-patched versions listed there (exact fixed build numbers are not enumerated in the provided data - confirm from the advisory). Because exploitation depends on a user opening a malicious file that triggers loading of an untrusted search-path element, interim compensating controls include restricting who can place or deliver files into directories ColdFusion or its handlers read from, ensuring the application and JVM library search paths point only to trusted, non-user-writable locations, removing write permissions on ColdFusion install and working directories for standard users, and enforcing least-privilege on the account ColdFusion processes run as to limit the blast radius of code executed in the current user's context. These controls reduce exposure but do not remove the flaw, so patching remains mandatory.