Adobe ColdFusion missing authentication — CVSS 9.3
Missing authentication check in Adobe ColdFusion allows unauthenticated attackers to access protected functionality. Patched in ColdFusion 2025 Update 11 and 2023 Update 22.
- Vendor
- Adobe
- Product
- ColdFusion 2023, ColdFusion 2025
- CVSS
- 9.3
- EPSS (exploit probability)
- 0.6%
- Status
- patched
- Published
Is CVE-2026-48325 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-48325 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.6% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
A missing authentication check in Adobe ColdFusion exposes protected endpoints to unauthenticated remote attackers. The flaw was patched alongside seven other critical vulnerabilities in Adobe’s July 2026 ColdFusion security update.
Apply ColdFusion 2025 Update 11 or ColdFusion 2023 Update 22. Missing-authentication vulnerabilities in ColdFusion are historically among the fastest to appear in KEV; treat internet-exposed installations as highest priority.
Source: NVD · Adobe Security Bulletin
Other Adobe ColdFusion CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-48322 Adobe ColdFusion code injection — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 1.2% | — |
| CVE-2026-48321 Adobe ColdFusion authorization bypass — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.4% | — |
| CVE-2026-48319 Adobe ColdFusion path traversal — CVSS 9.1write-up | [ CRITICAL ] | 9.1 | 1.4% | — |
| CVE-2026-48284 Adobe ColdFusion input-validation failure — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 0.5% | — |
| CVE-2026-48318 Adobe ColdFusion path traversalwrite-up | [ CRITICAL ] | 9.9 | 1.1% | — |
| CVE-2026-48282 Adobe ColdFusion path-traversal to arbitrary code executionwrite-up | [ CRITICAL ] | 10.0 | 42.4% | |
| CVE-2017-3066 Adobe ColdFusion Deserialization Vulnerability | [ CRITICAL ] | 9.8 | 90.6% | |
| CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability | [ HIGH ] | 7.4 | 98.5% |
