What is the CVSS score of CVE-2026-48386?

CVE-2026-48386 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48386?

Adobe ColdFusion versions 2023 and 2025 contain a cryptographic vulnerability that exposes sensitive application data-including session tokens and system credentials-to unauthenticated remote…

How to fix or mitigate CVE-2026-48386?

Within 24 hours, inventory all Adobe ColdFusion 2023 and 2025 systems and assess network exposure; establish an incident response task force and immediately review authentication logs for anomalous access patterns. Within 7 days, implement network segmentation to restrict ColdFusion server access to essential systems only, deploy Web Application Firewall rules to detect exploitation attempts, and enable comprehensive logging for authentication and cryptographic operations. Within 30 days, monitor Adobe security advisories for patch availability, develop a phased upgrade strategy to patched ColdFusion versions or alternative platforms prioritizing systems processing sensitive data, and conduct forensic log analysis for compromise indicators.

Adobe ColdFusion CVE-2026-48386

EUVD-2026-56540 HIGH

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-08-11 adobe

GHSA-mhrh-m637-x6jp

Information Disclosure Adobe Coldfusion 2025 Coldfusion 2023

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-exploitable broken cryptography with no auth or interaction required; only confidentiality is impacted, with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 17:25 vuln.today

CVE Published

Aug 11, 2026 - 16:30 nvd

HIGH 7.5

DescriptionCVE.org

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.

AnalysisAI

Sensitive memory disclosure in Adobe ColdFusion 2023 and 2025 stems from the server's use of a broken or risky cryptographic algorithm (CWE-327), enabling a remote unauthenticated attacker to retrieve confidential data - such as session tokens, credentials, or application secrets - that transit or reside in vulnerable cryptographic operations. Both the 2023 and 2025 product lines are confirmed affected per Adobe's own CPE data. No user interaction is required, and the CVSS vector confirms full network exploitability against default deployments. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) indicates that ColdFusion's internal cryptographic implementation relies on an algorithm known to be cryptographically weak - candidates include MD5, SHA-1, DES, RC4, or similar deprecated primitives - in a context that protects sensitive memory or data in transit. Adobe ColdFusion is a Java-based rapid application development platform that exposes numerous network services (HTTP/HTTPS, AMF, RMI) and performs cryptographic operations across session management, data encryption APIs, and inter-service communication. The affected CPE strings - cpe:2.3:a:adobe:coldfusion_2025 and cpe:2.3:a:adobe:coldfusion_2023 - cover all sub-versions of both major release lines, suggesting the flaw is in a shared cryptographic library or framework component rather than a feature-specific module. The root cause is a design or implementation choice to use an algorithm that offers insufficient security guarantees against modern cryptanalytic attacks.

RemediationAI

The primary remediation is to apply the patch released by Adobe under security bulletin APSB26-90, available at https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html; administrators should consult that advisory directly for the exact updated version numbers applicable to their ColdFusion 2023 or 2025 installation, as the CPE data provided does not enumerate a specific fixed build. Until the patch is applied, compensating controls should focus on network-layer restriction: limit inbound access to ColdFusion administrative interfaces and application endpoints to known trusted IP ranges via firewall or WAF rules, reducing the attack surface for unauthenticated network-based exploitation. Additionally, consider disabling non-essential ColdFusion services and protocols (AMF endpoints, RDS) that may expose cryptographic operations unnecessarily. Note that network segmentation alone does not eliminate the vulnerability for applications legitimately accessible from broader networks and should not substitute for patching.