What is the CVSS score of EUVD-2026-44548?

EUVD-2026-44548 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.4%.

Adobe ColdFusion EUVD-2026-44548

| CVE-2026-48329 LOW

Insufficient Session Expiration (CWE-613)

2026-07-14 psirt@adobe.com

GHSA-48rg-3g52-267g

Authentication Bypass Adobe Coldfusion

2.7

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

2.7 LOW

ColdFusion admin interface is network-accessible (AV:N); PR:H reflects mandatory high-privilege prerequisite; only limited write access gained, so I:L with no C or A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 12:04 vuln.today

DescriptionCVE.org

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

AnalysisAI

Insufficient session expiration in Adobe ColdFusion 2023 (through Update 21) and 2025 (through Update 10) allows a high-privileged authenticated attacker to reuse sessions that should have been invalidated, bypassing security controls to gain unauthorized write access. The CVSS score of 2.7 reflects the significant constraint of PR:H - the attacker must already hold high-level ColdFusion credentials. SSVC classification of exploitation:none and an EPSS of 0.35% (28th percentile) confirm no active exploitation or public exploit code at time of analysis.

Technical ContextAI

CWE-613 (Insufficient Session Expiration) describes a class of flaws where application sessions remain valid beyond their intended lifetime - typically after logout, privilege change, or administrative session rotation. In ColdFusion's case, session tokens that should be invalidated server-side can be reused by an attacker who has obtained them, bypassing the security boundary that the expiration mechanism is meant to enforce. The affected surface is Adobe ColdFusion's web application runtime, confirmed by CPE strings cpe:2.3:a:adobe:coldfusion:2023 covering the base release through update 17 per NVD, and extended to update 21 by EUVD data. The network attack vector (AV:N) is consistent with ColdFusion's administrator and server interfaces being HTTP-accessible, but PR:H indicates the session in question belongs to a high-privileged operator account.

RemediationAI

The primary fix is to upgrade to Adobe ColdFusion 2023 Update 22 or Adobe ColdFusion 2025 Update 11, per patch versions confirmed by EUVD and the Adobe advisory APSB26-82 (https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html). As a compensating control where patching is delayed, administrators should enforce explicit server-side session invalidation on logout and privilege changes via ColdFusion's Application.cfc sessionInvalidate() mechanism, and configure aggressive session timeout values in the ColdFusion Administrator under Server Settings > Memory Variables. Additionally, restricting network access to the ColdFusion Administrator interface to trusted management networks reduces the exposure surface for any session-related abuse. Note that session timeout reduction may affect legitimate user workflows and should be communicated to application owners before implementation.