VDB
CVE-2026-48282
CVE-2026-48282
PUBLISHED
KEV
CVSS 10 CRITICAL
Adobe has released security updates for ColdFusion versions 2025 and 2023. These updates resolves critical and important vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass. Adobe is aware that CVE-2026-48282 has been exploited in the wild in limited attacks targeting Adobe ColdFusion. Vulnerability: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Impact: Arbitrary code execution Severity: Critical CVSS: 10.0 CWE: CWE-22
EPSS 42.39% · 98.6th percentile
Risk Scores
CVSS 3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score
42.39%
98.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | ColdFusion 2025 | *, *, * |
| Adobe | Product | *, *, * |
| Adobe | ColdFusion 2023 | *, *, * |
Timeline
- Jun 26, 2021 CrowdSec Sighting
- Jan 19, 2022 CrowdSec Sighting
- Sep 27, 2022 CrowdSec Sighting
- Oct 20, 2022 CrowdSec Sighting
- Oct 29, 2022 CrowdSec Sighting
- Dec 4, 2022 CrowdSec Sighting
- Dec 11, 2022 CrowdSec Sighting
- Apr 5, 2023 CrowdSec Sighting
- Aug 10, 2023 CrowdSec Sighting
- Jul 9, 2024 CrowdSec Sighting
- Jul 13, 2024 CrowdSec Sighting
- Nov 1, 2024 CrowdSec Sighting