CVE-2026-48281

ColdFusion | Improper Input Validation (CWE-20)

No known exploitation. EPSS puts it in the 73rd percentile. Fixed versions are out.

CVSS 3.110.0Critical EPSS percentile73rd1.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2 products2 fixed builds listed below

Published 2026-06-30Updated 2026-10-25Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Adobe ColdFusion 2025Affected: ≤ 9Upgrade to: after 9Fixed builds10Stated by: CVE record
Adobe ColdFusion 2023Affected: ≤ 20Upgrade to: after 20Fixed builds21Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which ColdFusion version you run (and confirm whether it’s 2025.9, 2023.20, or an earlier release).
If you are on an affected version, upgrade ColdFusion using the vendor security update listed in APSB26-68.
If you can’t upgrade immediately, restrict network access to the ColdFusion server so it’s not reachable from the open internet, and limit access to only the systems/users that must use it.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

4 publishers

Vendor patch released
as reported · Jul 2, 2026·watchTowr Labs summary

Sourced from public security reporting — each date is when it was published, not when it happened. 2 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

In plain language

Written by AI from the record

CVE-2026-48281 is a serious ColdFusion flaw that can let an attacker run code on the server over the network without any login, so you should check whether your ColdFusion version is affected and upgrade promptly if it is.

CVE-2026-48281 is an Improper Input Validation vulnerability in ColdFusion that can enable remote, unauthenticated execution of arbitrary code over the network without user interaction (attackers supply malicious input that ColdFusion mishandles).

If you're affected

Full server compromise
Data theft risk
Business disruption
Malware deployment

What is it

Think of ColdFusion like a program that accepts “instructions” from the internet. This flaw means it can be tricked into treating specially crafted input as real commands, which can let an attacker take over the server’s behavior. There’s no need for the attacker to log in or trick a user into clicking anything.

Who is affected

This matters if you use and expose Adobe ColdFusion to the network, especially if it’s reachable from the internet. The findings indicate the vulnerability can be exploited without authentication and without user interaction, so the main question is whether your ColdFusion is reachable by an attacker over the network. If your ColdFusion isn’t publicly reachable (or is tightly firewalled to trusted networks only), the practical risk is lower, but it can’t be ruled out until reachability is confirmed.

How urgent is it

This is urgent because the flaw allows remote code execution without authentication or user interaction, meaning an attacker can potentially exploit it by sending crafted network requests. The issue is not listed as known exploited in the CISA KEV set, but it is still critical in nature for any internet-reachable ColdFusion system.

What to do — in detail

Confirm exposure
- Identify the exact ColdFusion version installed (for example, check whether it matches 2025.9, 2023.20, or is earlier).
- Determine how it’s reachable: from the internet, from a DMZ, from an internal network only, or behind a VPN/load balancer.
Determine whether you’re affected
- If your version is 2025.9, 2023.20, or earlier, treat you as affected based on the provided findings.
Patch
- Apply Adobe’s remediation from APSB26-68: https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html
- After updating, verify ColdFusion reports the new version you intended and that services restarted successfully.
If you can’t patch immediately (temporary risk reduction)
- Block direct access to the ColdFusion server from the public internet.
- Allow only required source IP ranges (your application servers, admin jump host, monitoring systems).
- If you must keep it reachable, ensure access is restricted via firewall rules and/or a reverse proxy with strict allowlists.
Monitor
- Review ColdFusion/application logs and web server logs for suspicious requests around the time of any changes or unknown traffic.
- Watch for unexpected outbound connections, new processes spawned by the ColdFusion service, and unusual file changes within the ColdFusion application/runtime directories.

CISA due date: Not provided by the findings (KEV not listed).

Technical context

Severity is effectively critical: the vulnerability allows remote, unauthenticated execution of arbitrary code without user interaction. The weakness is Improper Input Validation (CWE-20), where malicious input is not handled safely and can be interpreted in a way that leads to code execution. The traffic-light verdict for this CVE is AMBER, and the provided findings do not list the issue in CISA KEV and do not show a clear dated exploitation claim in press; likewise, no public exploit code is on record. EPSS was provided as a low predicted likelihood figure with a flat trend, but that prediction is not treated as decisive here given the nature of the flaw.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS73rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.4% chance of exploitation activity in the next 30 days, which ranks it in the 73rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 117 days, from the signal feeds we watch.

2026-10-25Patch availablerecord updated
2026-08-28Patch availablerecord updated
2026-08-24Patch availablerecord updated
2026-07-15OpenVAS check added
2026-07-01Patch availablerecord updated
2026-06-30Publishedweakness classified, att&ck mapped

Affected products

Adobecommercial · USaka adobe systems inc.

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable