CVE-2026-48362

This vulnerability is like a broken “escape hatch” in ColdFusion where crafted input can be used to trick the server into running operating-system commands. In the worst case, that means an attacker could gain full control of the server and use it to install malware, steal data, or disrupt your operations.

This matters if you run or host applications on Adobe ColdFusion, specifically ColdFusion 2023 or ColdFusion 2025 that are not updated to the fixed versions. The risk is that an attacker can reach the ColdFusion service over the network without needing a login, and send crafted requests to trigger command execution. It’s a concern when the ColdFusion service is reachable from where attackers can reach it (e.g., from the internet or any exposed network path).

This is RED because the issue enables remote attackers to execute arbitrary commands on the server without authentication or user interaction. Even without confirmed public incidents, the combination of critical impact (full command execution, service-account context) and network reachability makes it a high-priority patch.

Confirm whether you’re exposed

• Identify the installed ColdFusion major version: ColdFusion 2023 or ColdFusion 2025.
• Check the exact build/update level currently installed.
• Compare against the vendor fixed versions:
  • ColdFusion 2025: fixed in 2025.0.12
  • ColdFusion 2023: fixed in 2023.0.23

Remediate

• Upgrade to the fixed build for your branch (2025.0.12 for ColdFusion 2025, or 2023.0.23 for ColdFusion 2023).
• Follow the vendor’s installation/upgrade steps from the vendor advisory linked below (and apply any required restart).
• Confirm post-upgrade:
  • ColdFusion service is running
  • The build/version shown by your installation matches the fixed release

Vendor guidance: https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html

If patching is delayed (temporary containment)

• Restrict who can reach ColdFusion over the network:
  • Block public internet access to ColdFusion unless absolutely required.
  • Limit access to known internal networks/IPs.
• Ensure any admin interfaces/endpoints are not exposed publicly.

What to monitor after updating

• Review ColdFusion and web server logs for suspicious requests targeting unusual parameters or patterns consistent with command execution attempts.
• Look for evidence of unexpected child processes, system command execution traces, or unusual outbound connections from the ColdFusion host.

KEV / exploitation notes

• This CVE is not listed in the CISA KEV catalog per the provided findings.
• The provided reporting indicates no clear dated public incident and no public exploit code on record, but the vulnerability is still critical due to its unauthenticated remote command-execution capability.

CVE-2026-48362 is a CWE-78 flaw in Adobe ColdFusion that can lead to OS command injection and arbitrary code execution on the server. The findings state: network attack vector, no authentication required, no user interaction, and execution occurs in the context of the current user (i.e., the service account running ColdFusion). The provided traffic-light verdict is RED.

Exploitation status (from findings):

• KEV: not listed.
• Press/incidents: no clear dated exploitation claim; no incidents reported in the findings.
• Public exploit code: none on record.
• A note in PULSE indicates actor chatter/association (Lazarus Group) as part of a roundup; this is not the same as confirmed exploitation and is treated accordingly in the findings.

Patch availability (from findings):

• ColdFusion 2025 fixed in 2025.0.12
• ColdFusion 2023 fixed in 2023.0.23

EPSS: provided as a prediction only (2.1%, flat trend) and should not be treated as proof of exploitation.