What is the CVSS score of EUVD-2026-44544?

EUVD-2026-44544 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 2.2%.

Which versions of Adobe ColdFusion are affected by EUVD-2026-44544?

Adobe ColdFusion versions 2023 (Update 21 and earlier) and 2025 (Update 10 and earlier) contain a critical unauthenticated remote code execution vulnerability (CVSS 9.6) that allows attackers from…

How to fix or mitigate EUVD-2026-44544?

Within 24 hours: Inventory all ColdFusion 2023 and 2025 deployments, identify current update levels, and assess network reachability from untrusted segments. Within 7 days: Implement network segmentation to restrict ColdFusion access to trusted internal networks only, deploy Web Application Firewall (WAF) rules to block exploitation attempts, and disable or isolate CFML services where operationally feasible. Within 30 days: Establish a patch readiness plan for immediate deployment when Adobe releases the fix (monitor APSB26-82 advisories), consider temporary application migration to alternate platforms if risk tolerance is low, and implement enhanced monitoring for unusual CFML process activity and inbound connections to ColdFusion ports.

Adobe ColdFusion EUVD-2026-44544

| CVE-2026-48284 CRITICAL

Improper Input Validation (CWE-20)

2026-07-14 psirt@adobe.com

GHSA-4vjh-4fjg-5f34

RCE Adobe Coldfusion

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Description confirms unauthenticated (PR:N), no user interaction (UI:N), arbitrary code execution (C/I/A:H) and changed scope; retained AV:A as Adobe scopes the vector to adjacent access rather than full network reach.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 17:44 vuln.today

v3 (cvss_changed)

CVSS changed

Aug 05, 2026 - 17:37 NVD

9.9 (CRITICAL) 9.6 (CRITICAL)

Analysis Updated

Jul 15, 2026 - 18:22 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 18:07 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 18:07 NVD

9.6 (CRITICAL) 9.9 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 21:43 vuln.today

CVE Published

Jul 14, 2026 - 21:16 nvd

CRITICAL 9.6

DescriptionNVD

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) allows an unauthenticated attacker on an adjacent network to run code in the context of the current user via improper input validation, with no user interaction required and a scope change extending impact beyond the vulnerable component. Adobe (APSB26-82) rates it CVSS 9.6; there is no public exploit identified at time of analysis and CISA's SSVC framework reports exploitation status 'none'. EPSS estimates a 2.17% 30-day exploitation probability (80th percentile), notable but not extreme for a critical-rated ColdFusion RCE.

Technical ContextAI

Adobe ColdFusion is a commercial rapid-application-development platform built on the JVM, using the CFML tag/scripting language and running as a Java web/application server (often fronted by IIS or Apache via connectors, or on the bundled Tomcat). The flaw is classed as CWE-20 (Improper Input Validation): ColdFusion accepts attacker-controlled input into a code path that fails to adequately validate it, ultimately allowing that input to influence execution and achieve arbitrary code execution. The CPE data confirms the affected line is the adobe:coldfusion:2023 branch across its update chain (base through update17 enumerated, with EUVD extending the range to Update 21) plus the ColdFusion 2025 branch. ColdFusion has a long history of input-validation and deserialization-style RCE issues, which makes an input-validation defect leading to code execution consistent with the product's known attack surface.

RemediationAI

Vendor-released patch: apply Adobe ColdFusion 2023 Update 22 or ColdFusion 2025 Update 11 as directed by Adobe security bulletin APSB26-82 (https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html). Because the attack vector is adjacent-network, the most effective compensating control while patching is network segmentation: restrict access to the ColdFusion server ports (default 8500 for the built-in server, plus the AJP/HTTP connector to your web server) so only trusted management hosts and the fronting web server can reach them, and remove ColdFusion administrative and application endpoints from untrusted VLANs and any broadcast/adjacent exposure. Apply Adobe's ColdFusion Lockdown Guide hardening (run the service as a low-privileged account, enable the secure profile, and remove unused CFML tags/components) to reduce the blast radius of the scope-changed code execution; the trade-off is that lockdown and connector ACLs can break legitimate integrations, so validate application functionality after applying them. Do not treat these controls as a permanent substitute for the update.