CVE-2026-48283

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

No known exploitation. EPSS puts it in the 69th percentile. Fixed versions are out.

CVSS 3.110.0Critical EPSS percentile69th1.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2 products2 fixed builds listed below

Published 2026-06-30Updated 2026-08-28Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Adobe ColdFusion 2025Affected: ≤ 9Upgrade to: after 9Fixed builds10Stated by: CVE record
Adobe ColdFusion 2023Affected: ≤ 20Upgrade to: after 20Fixed builds21Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your Adobe ColdFusion version and confirm whether you use file upload features (forms, portals, or APIs) that accept files from users or the public internet.
Verify whether ColdFusion is reachable from the internet on the web ports you expose (e.g., direct access to the ColdFusion web app).
Plan and apply Adobe’s security update for this issue, using the vendor advisory as your fixed reference: APSB26-68.
After upgrading, review and restrict upload endpoints to allow only safe file types, and ensure uploads cannot be executed as code by the server.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

3 publishers

Vendor patch released
as reported · Jul 2, 2026·watchTowr Labs summary

Sourced from public security reporting — each date is when it was published, not when it happened. 2 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

In plain language

Written by AI from the record

If you run Adobe ColdFusion versions 2025.9 or older, an attacker may be able to upload a dangerous file type and potentially run code on your server—this is a serious risk if your ColdFusion file upload features are reachable from the network.

ColdFusion has an unauthenticated, network-accessible unrestricted file upload flaw (CWE-434) that allows uploading dangerous file types which can be used for remote code execution in the ColdFusion service context; affected versions are 2025.9 and 2023.20 and earlier.

If you're affected

Server takeover
Malware installation risk
Data theft risk
Service disruption

What is it

This vulnerability is like leaving a “package drop” door open for anyone, where they can send not just normal documents, but a file that can behave like an application. If your ColdFusion server accepts those uploads, the attacker may be able to run code on your server using the same permissions as the ColdFusion service.

Who is affected

This matters if you run Adobe ColdFusion and your system is configured to allow file uploads that can be reached over the network. Based on the findings, exploitation does not require a victim to click anything and does not require the attacker to be logged in. The risk is primarily if the upload functionality is reachable from the internet (or any untrusted network) in the vulnerable version range (ColdFusion versions 2025.9, 2023.20 and earlier).

How urgent is it

This is urgent because the vulnerability enables remote code execution from the network and requires no login and no user interaction. Even though there’s no specific dated public incident report in the provided findings, the combination of “unrestricted dangerous uploads” plus full code execution makes it a high-priority patching item. This is marked AMBER severity for owners: act quickly, but proceed in an organized way to upgrade and limit exposure.

What to do — in detail

Confirm exposure in your environment
- Identify the exact Adobe ColdFusion version in use.
- Determine whether you have any endpoints/pages that accept file uploads (for example: profile picture uploads, document uploads, imports, or any form/controller that processes uploaded files).
- Confirm whether ColdFusion is reachable from the internet or from other untrusted networks on the exposed web ports.
Match your version to the affected range
- The findings state affected versions include ColdFusion versions 2025.9, 2023.20 and earlier.
- If you are in that range and file uploads are reachable, treat it as exposed.
Upgrade to the vendor fix
- Use Adobe’s security advisory APSB26-68 as the source of the fixed version(s) and upgrade steps: https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html.
- Plan the upgrade as a normal maintenance window (validate backups and test in staging if you have one).
- After upgrading, retest your upload features to ensure normal uploads still work.
If you cannot patch immediately (temporary containment)
- Remove or restrict public access to upload endpoints so they are not reachable from the internet.
- Add strict validation at the application level to restrict allowed file types to only those you truly need (and block dangerous types).
- Ensure uploaded content is stored/executed in a way that prevents it from being executed as code by the web server or application runtime.
What to monitor after the change
- Look for upload attempts to unusual extensions/types on your upload routes.
- Review ColdFusion application and web server logs for spikes in failed or suspicious upload requests.
- Confirm no unexpected new processes or scheduled tasks appear under the ColdFusion service account after any relevant testing period.

Technical context

Severity/verdict: AMBER. Weakness type: CWE-434 (unrestricted upload of file with dangerous type). Mechanism: an attacker can upload dangerous file types (such as executable/script-like payloads) through a ColdFusion file upload capability; if the upload is allowed, the attacker can then leverage it to execute arbitrary code with the same privileges as the ColdFusion service (remote code execution). Preconditions from findings: ColdFusion is installed and configured to allow file uploads; no user interaction is required; no authentication is required. Reachability: network-based, and default-config reachability is indicated for ColdFusion versions 2025.9, 2023.20 and earlier. Exploitation status in findings: no confirmed KEV listing and no dated press incident claim; no public exploit code on record; however, patch attention is noted and a vendor remediation is provided. EPSS prediction is present in the findings but should not be treated as proof of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS69th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.3% chance of exploitation activity in the next 30 days, which ranks it in the 69th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 59 days, from the signal feeds we watch.

2026-08-28Patch availablerecord updated
2026-08-24Patch availablerecord updated
2026-07-15OpenVAS check added
2026-07-01Patch availablerecord updated
2026-06-30Publishedweakness classified, att&ck mapped

Affected products

Adobecommercial · USaka adobe systems inc.

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable