Vulnerability intelligence

CVE-2026-48276

Adobe ColdFusion 2025 CWE-434

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS Score

Critical

EPSS — Exploit Probability

1.3%

Riskier than 68% of all CVEs · checked 2026-09-28

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Vendor fix published

NVD entry Vendor patch PoC / advisory