CVE-2026-48329
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
Risk Assessment
The risk is that a high-privileged attacker could gain unauthorized write access to the ColdFusion system, potentially leading to data or configuration modification without administrator awareness.
Recommendation
Apply the security update provided by the vendor for ColdFusion immediately, and review and shorten session expiration times in the server configuration.
Original NVD description (English source)
ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.