CVE-2026-48362

This vulnerability is like a broken “escape hatch” in ColdFusion where crafted input can be used to trick the server into running operating-system commands. In the worst case, that means an attacker could gain full control of the server and use it to install malware, steal data, or disrupt your operations.

This matters if you run or host applications on Adobe ColdFusion, specifically ColdFusion 2023 or ColdFusion 2025 that are not updated to the fixed versions. The risk is that an attacker can reach the ColdFusion service over the network without needing a login, and send crafted requests to trigger command execution. It’s a concern when the ColdFusion service is reachable from where attackers can reach it (e.g., from the internet or any exposed network path).

This is RED because the issue enables remote attackers to execute arbitrary commands on the server without authentication or user interaction. Even without confirmed public incidents, the combination of critical impact (full command execution, service-account context) and network reachability makes it a high-priority patch.