Adobe ColdFusion CVE-2026-48385

The attacker must possess a valid low-privileged ColdFusion application account (PR:L per CVSS vector) and network access to the ColdFusion server. Exploitation does not require user interaction and is confirmed to be network-reachable (AV:N). The vulnerability is described as not requiring any special non-default configuration - the OS command injection pathway exists in standard deployments of ColdFusion 2023 and 2025. The primary limiting factor for exploitation is the authentication requirement: an unauthenticated attacker cannot directly exploit this without first obtaining at least a low-privilege credential. Additionally, organizations that place ColdFusion behind a VPN, restrict access to trusted networks, or enforce IP allowlisting effectively raise the barrier to exploitation, as the attacker must first achieve network adjacency to the server. The scope change (S:C) and high integrity impact apply only if the command injection successfully escapes the application security boundary, which is expected given the CWE-78 classification.

The CVSS 7.7 score is well-supported by the vector components: AV:N (network-reachable without physical access), AC:L (no special race conditions or configuration quirks needed), PR:L (a low-privileged account suffices - any authenticated user), UI:N (fully automated exploitation once credentials are in hand), and S:C with I:H (high integrity impact across the broader system). This combination means an attacker who can obtain even minimal credentials - via phishing, credential stuffing, or default account abuse - can immediately exploit without further human involvement. No EPSS score was provided in the source intelligence; exploitation probability cannot be independently quantified from available data. No CISA KEV listing exists for this CVE at time of analysis, and no public POC has been identified, which lowers immediate mass-exploitation risk. However, the low complexity and no-user-interaction requirement mean that once a working exploit is developed, automated scanning and exploitation is straightforward. This should be treated as a priority patch for organizations running internet-exposed ColdFusion instances or those where low-trust users have application accounts.

An attacker with a low-privileged ColdFusion application account - obtained via phishing, credential reuse, or a default account - submits a crafted HTTP request to a vulnerable ColdFusion endpoint, embedding OS command metacharacters (e.g., semicolons, pipes, backticks) in a parameter that the application passes unsanitized to an OS command execution function. The injection bypasses ColdFusion's internal security checks, causing the underlying OS to execute attacker-controlled commands under the application server's process identity. Because scope is changed, the attacker achieves write access to file system paths or system resources outside the ColdFusion application's intended permission boundary - potentially writing webshells, modifying configuration files, or tampering with data accessible to the server OS account. No public POC has been identified at time of analysis.