NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

CVE-2026-48316

CVSS 3.1: 10.0 critical
EPSS: 1%p64
Published: Jul 6, 2026 · Jul 6, 2026
Modified: Oct 25, 2026

Analyze CVE-2026-48316 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Vendors: adobe

Products: coldfusion

Weakness: CWE-20

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news

3 stories

⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More

The Hacker NewsJul 6, 13:02 UTC · Jul 6, 2026RansomwareCVE-2026-48276 CVE-2026-48283 CVE-2026-48277+692

60

Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic

The Hacker NewsJul 3, 10:17 UTC · Jul 3, 2026VulnerabilityExploitedCVE-2026-48276 CVE-2026-48283 CVE-2026-48277+71

60

Adobe fixed multiple maximum-severity flaws in ColdFusion and Campaign Classic

Security AffairsJul 2, 09:28 UTC · Jul 2, 2026Threat actorExploitedCVE-2026-48276 CVE-2026-48283 CVE-2026-48277+71 · 1 read

60