VDB
CVE-2026-48320
CVE-2026-48320
PUBLISHED
CVSS 8.5 HIGH
Adobe has released security updates for ColdFusion versions 2025 and 2023. These updates resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates. Vulnerability: Cross-site Scripting (Reflected XSS) (CWE-79) Impact: Privilege escalation Severity: Critical CVSS: 8.5 CWE: CWE-79
EPSS 5.29% · 91.8th percentile
Risk Scores
CVSS 3.1
8.5
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS Score
5.29%
91.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | ColdFusion 2023 | * |
| Adobe | Product | * |
| Adobe | ColdFusion 2025 | * |
Timeline
- Jul 14, 2026 CVE Published
- Jul 15, 2026 Coalition ESS Score
- Jul 16, 2026 Security Advisory
- Aug 5, 2026 CVE Updated
- Aug 7, 2026 EPSS Score