NCSC-2026-0241 [1.00] [M/H] Vulnerabilities fixed in Adobe ColdFusion

CSIRTS triage

What

Several vulnerabilities can lead to arbitrary code execution, unauthorized privilege escalation, reading of arbitrary files, and bypassing security measures.

Who is affected

Deployments of Adobe ColdFusion versions 25.10, 23.21, and earlier.

Urgency

Remediation is important as these vulnerabilities could be exploited, although there is no known active exploitation at this time.

Action

Update to the latest version of Adobe ColdFusion.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

NCSC-NL Advisories (NL · national-cert · site)

Severity

unknown

Published

2026-07-16

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0241

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-483270.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all scored CVEs.
• Low exploitation riskCVE-2026-483250.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.
• Moderate exploitation riskCVE-2026-483241.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 68% of all scored CVEs.
• Low exploitation riskCVE-2026-483220.85% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 55% of all scored CVEs.
• Low exploitation riskCVE-2026-483210.77% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all scored CVEs.
• Elevated exploitation riskCVE-2026-4831932.3% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all scored CVEs.
• Elevated exploitation riskCVE-2026-4831823.5% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all scored CVEs.
• Elevated exploitation riskCVE-2026-4828428.0% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all scored CVEs.
• Elevated exploitation riskCVE-2026-4832013.0% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 96% of all scored CVEs.
• Low exploitation riskCVE-2026-483280.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• high[NEW] [high] Adobe ColdFusion: Multiple vulnerabilitiescert-bund
• mediumCVE-2026-48338: ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Pat…nvd
• highCVE-2026-48332: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result…nvd
• lowCVE-2026-48329: ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result i…nvd
• highCVE-2026-48328: ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Se…nvd
• criticalCVE-2026-48327: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitr…nvd
• criticalCVE-2026-48325: ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that co…nvd
• criticalCVE-2026-48324: ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Comman…nvd
• criticalCVE-2026-48322: ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnera…nvd
• criticalCVE-2026-48321: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privil…nvd
• highCVE-2026-48320: ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker co…nvd
• criticalCVE-2026-48319: ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Pat…nvd

More from NCSC-NL Advisories

• unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
• unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
• unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
• unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
• unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30