What is the CVSS score of EUVD-2026-40347?

EUVD-2026-40347 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Adobe ColdFusion are affected by EUVD-2026-40347?

Adobe ColdFusion versions 2025.9 and 2023.20 or earlier contain a critical arbitrary code execution vulnerability (CVE-2026-48315, CVSS 9.3) with no public exploit identified at time of analysis, but…

How to fix or mitigate EUVD-2026-40347?

Within 24 hours: Inventory all systems running ColdFusion 2025.9 or 2023.20 or earlier; alert end users to avoid opening untrusted files; enable email filtering for file types processed by ColdFusion. Within 7 days: Implement application sandboxing or network segmentation for ColdFusion systems; evaluate alternative web application servers. Within 30 days: Monitor Adobe security advisories for patch availability; establish migration timeline if needed; conduct security awareness training on social engineering and file handling.

Adobe ColdFusion EUVD-2026-40347

| CVE-2026-48315 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 adobe

GHSA-xp9f-h8r8-p4j7

RCE Adobe Coldfusion

9.3

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

Network-delivered malicious file with no auth (PR:N) but mandatory victim interaction (UI:R); script executes across the user's session boundary (S:C) impacting confidentiality and integrity, with no availability effect (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 16:20 vuln.today

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2025.9, 2023.20 and earlier stems from improper input validation (CWE-20) that lets an attacker craft a malicious file which, when opened by a victim, executes code in the context of the current user and can inject scripts to hijack the victim's account or session. The CVSS 3.1 base score is 9.3 (Critical) with a changed scope, reflecting cross-boundary impact once the victim is lured into interaction. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, so risk currently hinges on social-engineering a target into opening attacker-supplied content.

Technical ContextAI

ColdFusion is Adobe's commercial Java-based rapid web-application development platform and application server (CPE cpe:2.3:a:adobe:coldfusion), used to build and run CFML web applications. The root cause is CWE-20 Improper Input Validation: untrusted input contained in a file is not properly sanitized or validated before being processed/rendered, allowing malicious script content to be interpreted and executed. The CVSS scope-changed (S:C) flag combined with the 'inject malicious scripts into a web page' wording indicates the flaw crosses a security boundary - code/script executes in the victim's context (session/account) rather than being confined to the vulnerable component, consistent with a client-side execution or stored/processed-content injection pattern triggered by opening attacker-controlled input.

RemediationAI

Patch available per vendor advisory - apply the updates published in Adobe Security Bulletin APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html) for your release train (the 2025.x line beyond 2025.9 and the 2023.x line beyond 2023.20); exact fixed build numbers are not included in the provided input, so confirm and install the specific patched version from the advisory rather than an assumed number. Until patched, reduce exposure to the user-interaction trigger by treating ColdFusion-processed files from untrusted sources as hostile: restrict and validate file uploads/imports, avoid opening untrusted files in the ColdFusion administrator/developer context, and apply standard CFML input sanitization and output encoding on affected pages - note these are partial mitigations that do not remove the underlying validation flaw and may break legitimate workflows that rely on rich file content. Because the attack requires a victim opening a malicious file, end-user awareness and email/file-gateway filtering also lower realistic risk but are not substitutes for the patch.