Description
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Published: 2026-07-06
Score: 10 Critical
EPSS: 1.6% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper input validation flaw that permits arbitrary code execution in the context of the current user. The likely attack vector is a remote crafted request; based on the description, it is inferred that attackers can trigger it without any user interaction, leading to compromise of the system. The weakness is due to insufficient input checks.

Affected Systems

Adobe ColdFusion versions 2025.9, 2023.20, and all earlier releases are affected. Any server running these releases is vulnerable until a fix is applied or the application is removed.

Risk and Exploitability

The CVSS score of 10 indicates an extremely severe vulnerability. The EPSS score of 2% indicates a low but non-negligible likelihood of exploitation, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is remote and requires no user interaction; exploitation can be triggered by sending crafted input, making this a highly dangerous threat.

Generated by OpenCVE AI on August 3, 2026 at 05:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Adobe ColdFusion patch or upgrade to a supported release as detailed in Adobe Security Bulletin APSB26. If an immediate upgrade is not possible, place the service behind a firewall to limit exposure.
  • Deploy a web application firewall or implement application-level input‑validation rules to filter suspicious requests as a temporary countermeasure.
  • Restrict network exposure by limiting inbound traffic to trusted IP ranges.

Generated by OpenCVE AI on August 3, 2026 at 05:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe coldfusion
Vendors & Products Adobe
Adobe coldfusion

Mon, 06 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Description ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Title ColdFusion | Improper Input Validation (CWE-20)
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Adobe Coldfusion
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-07-07T13:10:00.267Z

Reserved: 2026-05-21T15:28:38.137Z

Link: CVE-2026-48316

cve-icon Vulnrichment

Updated: 2026-07-06T18:56:45.859Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-06T17:16:32.010

Modified: 2026-07-09T17:19:22.820

Link: CVE-2026-48316

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T05:15:18Z

Weaknesses
  • CWE-20

    Improper Input Validation