CVE Intelligence
Analysis AI-assisted

CVE-2026-48281: Adobe ColdFusion: Improper Input Validation Leading to Code Execution

CVE-2026-48281 is a critical Improper Input Validation issue (CWE-20) in Adobe ColdFusion that, according to the record, could allow arbitrary code execution in the context of the current user. The CVSS 3.1 base score is 10.0, with network attack vector, no privileges or user interaction required, and a changed scope. The record shows no CISA KEV listing and no fixed version, so the vendor advisory APSB26-68 should be consulted for remediation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-48281 affects Adobe ColdFusion and is classified as CWE-20, Improper Input Validation. The record describes it as a flaw that could result in arbitrary code execution in the context of the current user.

Impact

  • Confidentiality, integrity and availability: the CVSS 3.1 data in the record rates all three as High.
  • Scope: the record indicates that the scope is changed.
  • Privileges and interaction: the record states that no privileges and no user interaction are required.

Affected products and versions

  • The record names Adobe ColdFusion. The description cites versions 2025.9, 2023.20 and earlier.
  • The affected list in the record includes multiple update-level builds of the 2023 and 2025 branches. The record does not state how those builds map to the versions in the description.

Exploitation status

The record shows no CISA KEV listing. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.0142 with a percentile of 0.72154 as recorded.

Remediation and mitigation

  • Review the Adobe security advisory APSB26-68 and apply the vendor update for your ColdFusion branch.
  • The record contains no fixed version. This absence does not mean that no fix exists.
  • Until patched, limit network exposure of ColdFusion administrative and application interfaces and follow your internal hardening baseline.

Detection guidance

  • Monitor ColdFusion server logs for unusual requests, input-handling errors and unexpected changes to application files.
  • Watch for ColdFusion processes starting unexpected child processes or making unusual outbound connections, as a general indicator of compromise.

Limitations of the available information

The record lacks a fixed version list, vendor technical detail on the vulnerable component, and any exploitation telemetry beyond EPSS. Verify details against the vendor advisory and NVD.

Frequently asked questions

Does CVE-2026-48281 allow code execution?

According to the record, the flaw could result in arbitrary code execution in the context of the current user. The record does not describe the exact technical path.

Is a fixed version listed in the record?

No. The record contains no fixed version. Check the vendor advisory APSB26-68 for remediation details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.