AdobeCVE-2026-48316
Adobe ColdFusion: improper input validation
Critical10.0CVE-2026-48316 · Published Jul 6, 2026 · updated Aug 28, 2026
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| ColdFusion 2023 Product | <= 20 | No fix yet |
| ColdFusion 2025 Product | <= 9 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-20
More Adobe advisories
All Adobe| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 14 | Adobe Audition: out-of-bounds read | Medium5.5 | No fix yet |
| Jul 14 | Adobe Audition: out-of-bounds write | High7.8 | No fix yet |
| Jul 14 | Adobe Audition: out-of-bounds write | High7.8 | No fix yet |
| Jul 13 | Adobe ColdFusion: code execution | High8.2 | No fix yet |
| Jul 13 | Adobe ColdFusion: code execution | High8.2 | No fix yet |
| Jul 6 | Adobe DNG Software Development Kit (SDK): null pointer dereference | Medium5.5 | No fix yet |