CVE Intelligence
Analysis AI-assisted

CVE-2026-48277: Adobe ColdFusion Improper Input Validation

CVE-2026-48277 is an Improper Input Validation weakness (CWE-20) in Adobe ColdFusion, described as allowing arbitrary code execution in the context of the current user without user interaction. The CNA rates it critical with a CVSS 3.1 base score of 10. The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Adobe published a security advisory for ColdFusion describing an Improper Input Validation weakness (CWE-20). The record states that exploitation could lead to arbitrary code execution in the context of the current user and does not require user interaction. The scope is changed.

Impact

  • The CVSS 3.1 vector rates confidentiality, integrity and availability impact as High.
  • The CNA assigned a base score of 10 with a critical severity rating.
  • The record describes arbitrary code execution in the context of the current user.

Affected products and versions

  • Product: Adobe ColdFusion.
  • The description refers to versions 2025.9, 2023.20 and earlier.
  • The record also lists individual update branches for the 2023 and 2025 releases.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record, so active exploitation is not confirmed. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.01295 with a percentile of 0.6959, as recorded on 2026-10-13.

Remediation and mitigation

  • Review the Adobe security advisory APSB26-68 and apply the vendor update for your ColdFusion release branch.
  • The record does not list fixed versions, so confirm the fixed build in the advisory.
  • Until patched, limit network exposure of ColdFusion interfaces and apply least privilege to the service account that runs it.

Detection guidance

  • Review web server and application logs for unusual requests directed at ColdFusion.
  • Monitor for unexpected child processes started by the ColdFusion service.
  • Track unexpected file changes in ColdFusion directories.

Limitations of the available information

The record contains no fixed version list, no vendor exploitation details, and no technical description of the input vector. Affected version data comes from the record and should be verified against the advisory.

Frequently asked questions

Is CVE-2026-48277 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What does the vulnerability allow?

According to the record, it could result in arbitrary code execution in the context of the current user, without user interaction.

Which versions are affected?

The description cites ColdFusion 2025.9, 2023.20 and earlier, and the record lists several update branches of the 2023 and 2025 releases.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.