PT-2026-53900 · Adobe · Coldfusion

Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-48276

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions prior to 2025.10 Adobe ColdFusion versions prior to 2023.21

Description An unrestricted upload of files with dangerous types allows for arbitrary code execution in the context of the current user. The issue stems from improper input validation and content-type enforcement, enabling an attacker to remotely send a crafted upload request to a reachable endpoint. This exploitation does not require user interaction and can lead to full server compromise, lateral movement, and data theft.

Recommendations Upgrade to Adobe ColdFusion 2025.10 or later. Upgrade to Adobe ColdFusion 2023.21 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-48276

Affected Products

Coldfusion

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-48276 · Security Note
• https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html · Vendor Advisory
• https://twitter.com/UpwindMDR/status/2072011714657206494 · Twitter Post
• https://twitter.com/OrizonCyber/status/2071994686294630885 · Twitter Post
• https://twitter.com/SecAlertsCo/status/2071996725724598551 · Twitter Post