PT-2026-57865 · Adobe · Coldfusion

Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-48364

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.9 and earlier ColdFusion versions 2023.20 and earlier

Description An Uncontrolled Search Path Element issue exists that could allow arbitrary code execution in the context of the current user. This occurs when the application searches for a file in an uncontrolled directory, potentially loading a malicious library. Exploitation requires user interaction, specifically that a victim opens a malicious file.

Recommendations Update ColdFusion versions 2025.9 and earlier to a newer version. Update ColdFusion versions 2023.20 and earlier to a newer version.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2026-48364

Affected Products

Coldfusion

References · 4

• https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48364 · Security Note
• https://twitter.com/CVEnew/status/2076767958056292438 · Twitter Post
• https://twitter.com/infoflowcloud/status/2076770187668254732 · Twitter Post