CVE-2026-48385

What it is

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data tampering.

Exploit odds

1.6% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-11 17:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-08-28 00:17 UTC Last updatedMost recent change to the record

Details

Published

2026-08-11 17:18 UTC

Last modified

2026-08-28 00:17 UTC

Exploit probability

1.6% · EPSS, next 30 days

Weakness

CWE-78 · OS command injection

Record status

Analyzed

Affected

• Adobe Coldfusion 2023
• Adobe Coldfusion 2025

Attack profile CVSS 3.1 · 7.7

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None