What is the CVSS score of CVE-2026-48384?

CVE-2026-48384 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.7%.

Adobe ColdFusion CVE-2026-48384

EUVD-2026-56546 MEDIUM

Improper Input Validation (CWE-20)

2026-08-11 adobe

GHSA-3v5p-rr5w-rcj2

Denial Of Service Adobe Coldfusion 2025 Coldfusion 2023

4.9

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.9 MEDIUM

Requires high-privileged network-accessible credentials; no confidentiality or integrity impact; only availability is affected through application crash.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:34 vuln.today

DescriptionCVE.org

ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Improper input validation in Adobe ColdFusion 2023 and 2025 allows a remote attacker holding high-privileged credentials to crash the application server via a crafted network request, producing a denial-of-service condition. Affected versions are ColdFusion 2023 ≤ 2023.0.22 and ColdFusion 2025 ≤ 2025.0.11, with vendor-released patches documented in Adobe Security Bulletin APSB26-90. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Technical ContextAI

ColdFusion is Adobe's Java-based rapid web development application server, widely used in enterprise environments for dynamic content generation and business application hosting. The root cause is CWE-20 (Improper Input Validation): the server fails to adequately sanitize or validate attacker-controlled input before processing, allowing a specially crafted payload to trigger an unhandled condition that crashes the application process. CPE strings confirm two distinct product lines are affected: cpe:2.3:a:adobe:coldfusion_2025:*:*:*:*:*:*:*:* and cpe:2.3:a:adobe:coldfusion_2023:*:*:*:*:*:*:*:*. Because ColdFusion often serves as the application tier for business-critical workflows, an availability disruption can propagate to dependent services.

RemediationAI

Vendor-released patches are available: upgrade ColdFusion 2023 to patch level 2023.0.23 or later, and ColdFusion 2025 to patch level 2025.0.12 or later, as specified in Adobe Security Bulletin APSB26-90 at https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html. As a compensating control prior to patching, restrict network access to the ColdFusion administrative interface (typically port 8500 or via the web server connector) to trusted management IP ranges only, reducing the set of hosts that could deliver the malicious request. Additionally, audit and minimize the number of accounts holding high-privileged ColdFusion roles, as exploitation is contingent on PR:H credentials - reducing the account surface directly reduces exposure. Note that access restriction does not eliminate risk if the attacker is already an internal privileged user.