[NEW] [high] Adobe ColdFusion: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities allow an attacker to execute arbitrary program code, escalate privileges, conduct SQL injection and XSS attacks, bypass security precautions, and disclose information.

Who is affected

Users of Adobe ColdFusion are affected.

Urgency

Remediation is high priority due to the potential for severe impacts from exploitation.

Action

Update to the latest version of Adobe ColdFusion.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-07-15

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2364

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Elevated exploitation riskCVE-2026-4828428.0% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all scored CVEs.
• Elevated exploitation riskCVE-2026-4831823.5% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all scored CVEs.
• Elevated exploitation riskCVE-2026-4831932.3% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all scored CVEs.
• Elevated exploitation riskCVE-2026-4832013.0% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 96% of all scored CVEs.
• Low exploitation riskCVE-2026-483210.77% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all scored CVEs.
• Low exploitation riskCVE-2026-483220.85% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 55% of all scored CVEs.
• Moderate exploitation riskCVE-2026-483241.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 68% of all scored CVEs.
• Low exploitation riskCVE-2026-483250.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.
• Low exploitation riskCVE-2026-483270.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all scored CVEs.
• Low exploitation riskCVE-2026-483280.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownNCSC-2026-0241 [1.00] [M/H] Vulnerabilities fixed in Adobe ColdFusionncsc-nl
• mediumCVE-2026-48338: ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Pat…nvd
• highCVE-2026-48332: ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result…nvd
• lowCVE-2026-48329: ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result i…nvd
• highCVE-2026-48328: ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Se…nvd
• criticalCVE-2026-48327: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitr…nvd
• criticalCVE-2026-48325: ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that co…nvd
• criticalCVE-2026-48324: ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Comman…nvd
• criticalCVE-2026-48322: ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnera…nvd
• criticalCVE-2026-48321: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privil…nvd
• highCVE-2026-48320: ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker co…nvd
• criticalCVE-2026-48319: ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Pat…nvd

Recent advisories for Adobe ColdFusion

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownNCSC-2026-0241 [1.00] [M/H] Vulnerabilities fixed in Adobe ColdFusionncsc-nl · 2026-07-16
• critical[UPDATE] [critical] Adobe ColdFusion: Multiple Vulnerabilitiescert-bund · 2026-07-14
• criticalexploitedCVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerabilitycisa-kev · 2026-07-07
• unknownNCSC-2026-0217 [1.00] [M/H] Vulnerabilities fixed in Adobe ColdFusionncsc-nl · 2026-07-01
• unknownMultiple vulnerabilities in Adobe ColdFusion (July 1, 2026)cert-fr-avis · 2026-07-01
• criticalexploitedCVE-2017-3066: Adobe ColdFusion Deserialization Vulnerabilitycisa-kev · 2025-02-24

More from CERT-Bund (BSI) Security Advisories

• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow Denial of Service2026-07-31
• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-31
• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities2026-07-31
• medium[UPDATE] [medium] Linux Kernel (ntfs3): Vulnerability allows information disclosure2026-07-31