CVE-2026-48281
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk54th percentile — higher than 54% of all known CVEs
Summary
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Risk Assessment
An attacker can execute arbitrary code within the user's session, leading to compromise of confidentiality, integrity, and availability of organizational data.
Recommendation
Immediately update ColdFusion to version 2025.10 or later (for the 2025 line) and 2023.21 or later (for the 2023 line). If patching is not possible, restrict server access to trusted networks only.
Original NVD description (English source)
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.