CVE Intelligence
Analysis AI-assisted

CVE-2026-48283: Adobe ColdFusion Unrestricted File Upload Leading to Code Execution

CVE-2026-48283 affects Adobe ColdFusion versions 2025.9, 2023.20 and earlier, and is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The record states that exploitation could lead to arbitrary code execution in the context of the current user, requires no user interaction, and changes scope. The CNA assigned a CVSS 3.1 base score of 10.0, and the record does not list fixed versions or confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Adobe ColdFusion is affected by CVE-2026-48283, an Unrestricted Upload of File with Dangerous Type weakness (CWE-434). According to the record, the flaw could allow arbitrary code execution in the context of the current user. The vendor advisory is listed in the record as Adobe security bulletin APSB26-68.

Impact

  • The CNA psirt@adobe.com lists a CVSS 3.1 base score of 10.0 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
  • Under this vector, the attack is network-based, needs no privileges or user interaction, changes scope, and has high impact on confidentiality, integrity and availability.
  • The record describes the result as arbitrary code execution in the context of the current user. The actual impact depends on the privileges of the ColdFusion process and the environment.

Affected products and versions

The record names Adobe ColdFusion and states that versions 2025.9, 2023.20 and earlier are affected. The affected entries include many update builds across several release branches. The fixes field in the record is empty, so no fixed version is confirmed here. Administrators should check the vendor advisory for the authoritative list of affected and fixed builds.

Exploitation status

The record shows that CVE-2026-48283 is not listed in the CISA KEV catalog. No confirmed exploitation or active exploitation appears in the sources consulted for this analysis. The EPSS probability is 0.0126 with a percentile of 0.68862, as recorded, with a date field of 2026-10-13 that should be verified against the live EPSS data.

Remediation and mitigation

  • Identify all ColdFusion instances, including test and internal servers, and determine which build each runs.
  • Apply the fixes described in the Adobe security bulletin APSB26-68 as soon as practical, prioritizing internet-facing systems.
  • Until patched, restrict who can reach file upload functionality and limit accepted file types and storage locations to what the application requires.
  • Run the ColdFusion service with the least privileges needed, and segregate upload storage from executable web content.
  • Review whether unexpected files have already been stored by the application.

Detection guidance

  • Review upload directories and web-accessible paths for files that the application does not normally create, especially server-side script or executable file types.
  • Monitor web server and application logs for unusual upload requests from unknown sources or unexpected spikes in upload activity.
  • Alert on unexpected child processes started by the ColdFusion service account.
  • Compare file integrity baselines for application directories after any suspicious activity.

Limitations of the available information

  • The record contains no fixed version list, so the remediation build must be confirmed in the vendor advisory.
  • The record provides no technical details beyond the CWE classification and the description, and no public exploit information is included.
  • The record has no CISA KEV entry and no SSVC data.
  • The EPSS date field is unusual and should be verified before relying on the EPSS values.
  • This analysis did not review the content of the vendor advisory beyond its listing in the record.

Frequently asked questions

What is CVE-2026-48283?

It is an Unrestricted Upload of File with Dangerous Type weakness (CWE-434) in Adobe ColdFusion versions 2025.9, 2023.20 and earlier, according to the record.

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which fixed version should I install?

The record does not list fixed versions. Check the Adobe security bulletin APSB26-68 for the fixed builds for your release branch.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.