What is the CVSS score of CVE-2026-48375?

CVE-2026-48375 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Adobe ColdFusion CVE-2026-48375

EUVD-2026-56545 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-11 adobe

GHSA-v75c-vpwj-ppq3

Authentication Bypass Adobe Coldfusion 2025 Coldfusion 2023

6.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

PR:L required because valid low-privilege credentials are prerequisite; A:H reflects full application crash; C:N/I:N confirmed by DoS-only impact description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:34 vuln.today

DescriptionCVE.org

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

ColdFusion 2023 and 2025 contain an Incorrect Authorization flaw (CWE-863) that allows any low-privileged authenticated user to remotely crash the application server, producing a denial-of-service condition. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only network access and a valid low-privilege credential with no interaction from other users, making repeated service disruption trivial for any credentialed attacker. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Adobe ColdFusion is a Java-based application server for CFML (ColdFusion Markup Language) web applications, widely used in enterprise environments. CWE-863 (Incorrect Authorization) indicates the application performs an authorization check but the check is insufficiently enforced - a low-privileged user is permitted to invoke operations or reach code paths that should be restricted to higher-privilege contexts, in this case triggering a crash of the application server process. Affected CPEs are cpe:2.3:a:adobe:coldfusion_2023:*:*:*:*:*:*:*:* (all sub-versions through 2023.0.22) and cpe:2.3:a:adobe:coldfusion_2025:*:*:*:*:*:*:*:* (all sub-versions through 2025.0.11). The vendor-assigned tag 'Authentication Bypass' suggests the authorization logic is bypassed rather than simply weakened, allowing a low-privilege session to exercise privileges beyond its role boundary.

RemediationAI

Vendor-released patches are available: upgrade ColdFusion 2023 to patch level 2023.0.23 or later, and ColdFusion 2025 to patch level 2025.0.12 or later, as detailed in Adobe Security Bulletin APSB26-90 at https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html. Where immediate patching is not feasible, restrict ColdFusion application and administrative interfaces to trusted internal network segments or VPN-only access to reduce the pool of potential low-privilege accounts that could reach the vulnerable endpoint - note this does not eliminate risk from insider threats or already-compromised credentials. Additionally, enforce strict account lifecycle controls to minimize the number of active low-privilege ColdFusion accounts, and implement process-level monitoring and auto-restart policies to reduce mean time to recovery if the crash is triggered.