Adobe ColdFusion path traversal
Path-traversal vulnerability in Adobe ColdFusion that could result in arbitrary code execution. The highest-scored CVE in Adobe's July 2026 ColdFusion cluster. Fixed in ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22.
- Vendor
- Adobe
- Product
- ColdFusion 2025 (pre-Update 11), ColdFusion 2023 (pre-Update 22)
- CVSS
- 9.9
- EPSS (exploit probability)
- 1.1%
- Status
- patched
- Published
Is CVE-2026-48318 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-48318 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.1% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
CVE-2026-48318 is a path-traversal vulnerability in Adobe ColdFusion. NVD scores it 9.9 (critical) — the highest-severity item in Adobe’s July 2026 ColdFusion release, one of eight CVEs at CVSS 9.0 or higher patched simultaneously.
The fix ships in ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22. Adobe has not marked the bug as exploited in the wild at press time. Internet-exposed ColdFusion has a long track record of KEV appearances (CVE-2023-26360, CVE-2024-20767, CVE-2024-53961) — the historical gap from public advisory to observed exploitation on ColdFusion criticals has been short.
See Adobe’s ColdFusion security bulletin index for the authoritative advisory. Sibling ColdFusion criticals in the same release: CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, CVE-2026-48327.
Full coverage: Firefox exploit code public; Chrome, Adobe patch same day.
Other Adobe ColdFusion CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-48325 Adobe ColdFusion missing authentication — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.6% | — |
| CVE-2026-48322 Adobe ColdFusion code injection — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 1.2% | — |
| CVE-2026-48321 Adobe ColdFusion authorization bypass — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.4% | — |
| CVE-2026-48319 Adobe ColdFusion path traversal — CVSS 9.1write-up | [ CRITICAL ] | 9.1 | 1.4% | — |
| CVE-2026-48284 Adobe ColdFusion input-validation failure — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 0.5% | — |
| CVE-2026-48282 Adobe ColdFusion path-traversal to arbitrary code executionwrite-up | [ CRITICAL ] | 10.0 | 42.4% | |
| CVE-2017-3066 Adobe ColdFusion Deserialization Vulnerability | [ CRITICAL ] | 9.8 | 90.6% | |
| CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability | [ HIGH ] | 7.4 | 98.5% |
