CVE-2026-48321
Adobe ColdFusion 2023 is vulnerable to an incorrect authorization flaw that lets attackers gain unauthorized read and write access. The flaw can be exploited without user interaction and can lead to privilege escalation. It is rated critical with a CVSS score of 9.3.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Adobe ColdFusion 2023 (all listed builds).
Real-world impact
An attacker could read or modify files and data on the server, potentially taking full control of the application.
Why this severity
The CVSS score is high because the vulnerability allows attackers to bypass authorization checks, giving them high-level access without any user action. The attack vector is local (AV:A) and the attack complexity is low, so it is easy to exploit.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 14, 2026 · 16d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 17h agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- helpx.adobe.com/security/products/coldfusio…vendor advisory