Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-48316: ColdFusion: Unvalidated User Input Can Execute Code
CVE-2026-48316
CVE-2026-48316
Summary
ColdFusion versions 2025.9 and earlier are affected by a security issue that could allow an attacker to execute code with the privileges of the current user. This means an attacker could potentially access sensitive data or take control of the system. We recommend updating to the latest version of ColdFusion to protect against this risk.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| adobe | coldfusion | <= 2023.20 |
Original title
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploita...
Original description
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
nvd CVSS3.1
10.0
Vulnerability type
CWE-20
Improper Input Validation
Published: 6 Jul 2026 · Updated: 23 Jul 2026 · First seen: 6 Jul 2026