AdobeCVE-2026-48364
Adobe ColdFusion: code execution
High8.2CVE-2026-48364 · Published Jul 13, 2026 · updated Aug 28, 2026
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| ColdFusion 2023 Product | <= 20 | No fix yet |
| ColdFusion 2025 Product | <= 9 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-427
More Adobe advisories
All Adobe| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 14 | Adobe Audition: out-of-bounds write | High7.8 | No fix yet |
| Jul 14 | Adobe Audition: out-of-bounds write | High7.8 | No fix yet |
| Jul 14 | Adobe Audition: out-of-bounds read | Medium5.5 | No fix yet |
| Jul 14 | Adobe Audition: out-of-bounds write | High7.8 | No fix yet |
| Jul 14 | Adobe Audition: out-of-bounds write | High7.8 | No fix yet |
| Jul 13 | Adobe ColdFusion: code execution | High8.2 | No fix yet |