Adobe ColdFusion code injection — CVSS 9.6
Code injection in Adobe ColdFusion allows unauthenticated remote code execution. Patched in ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22.
- Vendor
- Adobe
- Product
- ColdFusion 2023, ColdFusion 2025
- CVSS
- 9.6
- EPSS (exploit probability)
- 1.2%
- Status
- patched
- Published
Is CVE-2026-48322 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-48322 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.2% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
Adobe ColdFusion contains a code injection vulnerability that allows an unauthenticated remote attacker to execute arbitrary code on affected installations. The flaw was addressed in Adobe’s July 2026 security update, which shipped fixes for eight ColdFusion criticals in the same batch.
Apply ColdFusion 2025 Update 11 or ColdFusion 2023 Update 22. ColdFusion has a documented history of rapid exploitation following advisory publication — treat this as an emergency-priority patch if the server is internet-exposed.
Source: NVD · Adobe Security Bulletin
Other Adobe ColdFusion CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-48325 Adobe ColdFusion missing authentication — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.6% | — |
| CVE-2026-48321 Adobe ColdFusion authorization bypass — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.4% | — |
| CVE-2026-48319 Adobe ColdFusion path traversal — CVSS 9.1write-up | [ CRITICAL ] | 9.1 | 1.4% | — |
| CVE-2026-48284 Adobe ColdFusion input-validation failure — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 0.5% | — |
| CVE-2026-48318 Adobe ColdFusion path traversalwrite-up | [ CRITICAL ] | 9.9 | 1.1% | — |
| CVE-2026-48282 Adobe ColdFusion path-traversal to arbitrary code executionwrite-up | [ CRITICAL ] | 10.0 | 42.4% | |
| CVE-2017-3066 Adobe ColdFusion Deserialization Vulnerability | [ CRITICAL ] | 9.8 | 90.6% | |
| CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability | [ HIGH ] | 7.4 | 98.5% |
