Adobe ColdFusion CVE-2026-48386

No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of Adobe ColdFusion 2023 and ColdFusion 2025. The attacker must have network access to a ColdFusion endpoint that exercises the vulnerable cryptographic operation, which in a typical deployment is any HTTP/HTTPS-accessible service interface. Exploitation is limited solely by network reachability: ColdFusion instances not exposed to untrusted networks (e.g., strictly internal deployments behind a firewall with no external access) face materially reduced risk. No elevated privileges, no authenticated session, and no victim interaction are required.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately captures the most dangerous aspect of this vulnerability: it is fully remotely exploitable without authentication, without user interaction, and with low attack complexity, making automated scanning and exploitation straightforward. The high confidentiality impact reflects the potential to recover sensitive memory contents - which in ColdFusion deployments frequently includes database credentials, session tokens, and encryption keys. No CISA KEV listing exists and no public exploit code has been identified, but the low attack complexity means even a mid-sized municipal IT team in inowroclaw managing a ColdFusion instance should treat this as urgent patching rather than a deferred item. The absence of integrity or availability impact keeps this from reaching critical territory, but the information disclosure risk is non-trivial given ColdFusion's typical role handling business-critical data. The EPSS signal is not provided in the source data and cannot be extrapolated; however, network-accessible, zero-interaction cryptographic disclosure vulnerabilities in widely-recognized products historically attract exploit development within weeks of disclosure.

An unauthenticated remote attacker sends a series of crafted HTTP requests to a publicly accessible ColdFusion server, targeting a cryptographic operation exposed over the network - such as a session establishment endpoint or an encrypted data API - that relies on a broken algorithm. By analyzing the server's responses and leveraging known weaknesses in the underlying cryptographic primitive, the attacker recovers sensitive memory contents, potentially including session tokens or application credentials. No interaction from a legitimate user is required, and the attack is feasible from any network-adjacent position.