What is the CVSS score of CVE-2026-48364?

CVE-2026-48364 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48364?

Adobe ColdFusion versions 2025.9 and 2023.20 contain an arbitrary code execution vulnerability triggered when users open malicious files, with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-48364?

Within 24 hours, conduct an inventory of all systems running Adobe ColdFusion 2025.9 or 2023.20, and implement file access restrictions on directories where ColdFusion processes may open or access files. Within 7 days, restrict ColdFusion service access to authorized administrators only in non-production environments or disable services if not business-critical; establish logging and monitoring for abnormal ColdFusion process execution. Within 30 days, contact Adobe Support for patched version availability and timeline, evaluate migration to newer unaffected versions, and document any compensating controls currently in place.

Adobe ColdFusion CVE-2026-48364

HIGH

Uncontrolled Search Path Element (CWE-427)

2026-07-13 adobe

RCE Adobe Coldfusion

8.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Local search-path hijack needs a low-priv foothold (PR:L) and a victim to open a malicious file (AV:L/UI:R); code runs as the user with changed scope (S:C) and full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:01 vuln.today

CVE Published

Jul 13, 2026 - 20:03 cve.org

HIGH 8.2

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and earlier arises from an uncontrolled search path element (library-hijacking-style) flaw that runs attacker code in the context of the current user when a victim opens a malicious file. The CVSS 3.1 base score is 8.2 with a changed scope, and exploitation is gated by user interaction and low-privilege local access. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

ColdFusion is Adobe's commercial rapid web-application development platform and Java-based application server used to build and run CFML applications. The root cause is CWE-427 (Uncontrolled Search Path Element): a library, executable, or resource is resolved using an insufficiently constrained search path, allowing a malicious file placed earlier in that search order to be loaded instead of the trusted one. Because the CPE 'cpe:2.3:a:adobe:coldfusion:*' covers all builds up to and including 2025.9 and 2023.20, both the current and prior supported tracks are in scope. The changed-scope (S:C) marking indicates the executed code can affect resources beyond the vulnerable component's own security authority.

RemediationAI

Apply the Adobe security update referenced in advisory APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html); consult that advisory for the exact fixed build numbers for the 2025 and 2023 tracks, as the precise patched version was not included in the input data and should not be assumed. Because exploitation depends on a user opening a malicious file, effective compensating controls until patching include restricting write access to ColdFusion install and working directories so untrusted libraries cannot be planted in the search path, blocking delivery of untrusted files to systems running ColdFusion tooling, and enforcing application allow-listing to prevent loading of unsigned libraries - the trade-off being added administrative overhead and potential disruption to legitimate custom extensions. Avoid running ColdFusion administrative tooling under privileged accounts to limit the impact of the changed scope.