VDB
CVE-2026-48325
CVE-2026-48325
PUBLISHED
CVSS 9.300000190734863 CRITICAL
Adobe has released security updates for ColdFusion versions 2025 and 2023. These updates resolve critical, important, and moderate vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates. Vulnerability: Missing Authentication for Critical Function (CWE-306) Impact: Arbitrary code execution Severity: Critical CVSS: 9.3 CWE: CWE-306
EPSS 0.51% · 40.9th percentile
Risk Scores
CVSS 3.1
9.300000190734863
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS Score
0.51%
40.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | ColdFusion 2023 | *, * |
| Adobe | Product | *, * |
| Adobe | ColdFusion 2025 | *, * |
Timeline
- Jul 14, 2026 CVE Published
- Jul 15, 2026 Coalition ESS Score
- Jul 15, 2026 CVE Updated
- Jul 16, 2026 Security Advisory
- Aug 7, 2026 EPSS Score