CVE-2026-48315: Adobe ColdFusion Improper Input Validation
CVE-2026-48315 is a critical Improper Input Validation flaw (CWE-20) in Adobe ColdFusion, scored 9.3 under CVSS 3.1 by the CNA. The CNA description says it could lead to code execution in the current user's context and requires a victim to open a malicious file. The record shows no KEV listing and no fixed version, so defenders should consult Adobe advisory APSB26-68.
Overview
CVE-2026-48315 is an Improper Input Validation weakness (CWE-20) affecting Adobe ColdFusion versions described as 2025.9, 2023.20 and earlier. The CNA scored it 9.3 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. The vendor advisory is referenced as APSB26-68.
Impact
The CNA description states that the flaw could result in arbitrary code execution in the context of the current user. It also describes injection of malicious scripts into a web page that could lead to elevated access or control over a victim's account or session. The vector indicates a network attack vector, no privileges required, user interaction required, changed scope, and high confidentiality and integrity impact with no availability impact. Because the description mixes code execution and script injection wording, the exact impact class should be confirmed against the vendor advisory.
Affected products and versions
- Product listed: Adobe ColdFusion.
- The record lists affected update levels across the 2025 and 2023 branches; the description names 2025.9 and 2023.20 and earlier.
- The record does not provide a fixed version. Its absence does not mean no fix exists; check the vendor advisory.
Exploitation status
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.01028 (percentile 0.62724) in the record dated 2026-10-13. EPSS estimates likelihood of exploitation and is not evidence of attacks.
Remediation and mitigation
- Inventory all ColdFusion instances and compare their update levels with the affected list.
- Apply the fix recommended in Adobe advisory APSB26-68 as soon as the affected status is confirmed.
- Until patched, restrict which files users may open from external or untrusted sources, and limit exposure of administrative interfaces.
- Run the ColdFusion service with least privilege.
Detection guidance
- Review ColdFusion and web application logs for unusual file handling or unexpected requests.
- Monitor for unexpected script or child process activity started by the ColdFusion service account.
- Alert on unusual user session behavior following interaction with externally sourced files.
Limitations of the available information
The record has no English title, no fixed versions, no vendor advisory text beyond a reference link, and no CISA KEV or SSVC data. The description contains both code execution and script injection wording, and exploitation depends on a victim action. Confirm details in the vendor advisory.
Frequently asked questions
What is CVE-2026-48315?
It is an Improper Input Validation flaw (CWE-20) in Adobe ColdFusion, scored 9.3 under CVSS 3.1 by the CNA. The description covers code execution in the current user's context and requires a victim to open a malicious file.
Which ColdFusion versions are affected?
The description names ColdFusion 2025.9, 2023.20 and earlier. The record lists affected update levels across the 2025 and 2023 branches, but it provides no fixed version.
Is this CVE being actively exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Teams should still prioritize patching based on the vendor advisory.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.