CVE-2026-48277
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk54th percentile — higher than 54% of all known CVEs
Summary
A vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier is caused by improper input validation, potentially leading to remote arbitrary code execution in the context of the current user. Exploitation requires no user interaction and the scope is changed.
Risk Assessment
The organization risks system compromise where an attacker can execute arbitrary code, leading to data theft, malware installation, or complete system integrity violation.
Recommendation
Immediately update ColdFusion to version 2025.10 or 2023.21, which include a fix for this vulnerability. As a temporary measure, restrict server access to trusted networks only.
Original NVD description (English source)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.