Adobe ColdFusion CVE-2026-48384

Exploitation requires an account with high privileges on the ColdFusion server, as confirmed by the CVSS vector PR:H - this limits the attacker pool to administrators, privileged service accounts, or insider threats with elevated access. The attacker must be able to deliver a crafted request over the network to the ColdFusion application (AV:N), but no victim user interaction is required (UI:N). There is no indication from the available data that a non-default configuration setting or specific ColdFusion feature must be enabled - the vulnerability appears to exist in the base product. The primary limiting factor is the mandatory high-privilege prerequisite, which distinguishes this from broadly exploitable unauthenticated denial-of-service vulnerabilities.

The CVSS 3.1 score of 4.9 (Medium) is appropriate given the PR:H requirement, which is the dominant risk-limiting factor: exploitation is gated on the attacker already holding high-privileged access to the ColdFusion environment. The network attack vector (AV:N) and low attack complexity (AC:L) mean that once those credentials exist, the crash is reliably reproducible remotely without user interaction. The impact triad is C:N/I:N/A:H, confirming this is a pure availability issue with no data exposure or integrity risk. No EPSS score was provided in the source data, so exploitation probability cannot be quantified from that signal. The vulnerability does not appear in the CISA KEV catalog, and no POC code has been identified, indicating no confirmed active exploitation. Taken together, this vulnerability is a realistic insider-threat or compromised-admin-account scenario rather than an externally-driven mass-exploitation risk; the threat model is intentional disruption by a privileged user, not opportunistic remote compromise.

An authenticated ColdFusion administrator or privileged service account submits a specially crafted request to the ColdFusion server that bypasses input validation, triggering an unhandled error that terminates the application process. All active sessions and dependent application workflows are immediately disrupted until an operator manually restarts the service. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means a motivated insider or attacker with compromised admin credentials could reproduce this reliably.