Adobe ColdFusion authorization bypass — CVSS 9.3
Authorization bypass in Adobe ColdFusion allows an unauthenticated attacker to bypass access controls. Patched in ColdFusion 2025 Update 11 and 2023 Update 22.
- Vendor
- Adobe
- Product
- ColdFusion 2023, ColdFusion 2025
- CVSS
- 9.3
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-48321 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-48321 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
Adobe ColdFusion contains an authorization bypass vulnerability that allows an unauthenticated remote attacker to circumvent access controls and reach protected functionality. Patched as part of Adobe’s July 2026 ColdFusion security update alongside seven other critical CVEs in the same product.
Apply ColdFusion 2025 Update 11 or ColdFusion 2023 Update 22. Authorization bypasses in server-side platforms with a KEV history like ColdFusion warrant immediate patching on any internet-exposed installation.
Source: NVD · Adobe Security Bulletin
Other Adobe ColdFusion CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-48325 Adobe ColdFusion missing authentication — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.6% | — |
| CVE-2026-48322 Adobe ColdFusion code injection — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 1.2% | — |
| CVE-2026-48319 Adobe ColdFusion path traversal — CVSS 9.1write-up | [ CRITICAL ] | 9.1 | 1.4% | — |
| CVE-2026-48284 Adobe ColdFusion input-validation failure — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 0.5% | — |
| CVE-2026-48318 Adobe ColdFusion path traversalwrite-up | [ CRITICAL ] | 9.9 | 1.1% | — |
| CVE-2026-48282 Adobe ColdFusion path-traversal to arbitrary code executionwrite-up | [ CRITICAL ] | 10.0 | 42.4% | |
| CVE-2017-3066 Adobe ColdFusion Deserialization Vulnerability | [ CRITICAL ] | 9.8 | 90.6% | |
| CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability | [ HIGH ] | 7.4 | 98.5% |
