← Back to Vulnerability Reports CVE Intelligence

CVE-2026-48362

Adobe Coldfusion•CRITICAL · CVSS 10•No exploitation reported

What is CVE-2026-48362?

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS10 NVD 3.1

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS4% · P89

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWECWE-78

NVD published2026-08-11

NVD last modified2026-08-28

Timeline

2026-08-11Published to the U.S. National Vulnerability Database (NVD)
2026-08-13First covered in a defend.network daily briefing
2026-08-28NVD record last updated

Affected product

Adobe Coldfusion

Remediation Steps

Apply Adobe security update for ColdFusion OS command injection
Review and update ColdFusion instances to patched versions
Audit system command execution logs for suspicious activity
Restrict ColdFusion application permissions to minimum required

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of August 2026 (August 17 – 23)
Vulnerability Priority Report – Week 2 of August 2026 (August 10 – 16)
Lazarus Windows zero-day, Adobe CVSS 10.0 patches, 737 malicious Chrome VPN extensions (2026-08-13)

Related vulnerabilities

CVE-2026-48282 – Adobe ColdFusion (same product)
CVE-2026-75682 – Adobe Connect (same vendor)
CVE-2026-75650 – Adobe Commerce And Magento (same vendor)
CVE-2026-71362 – Adobe Commerce And Magento (same vendor)
CVE-2026-48449 – Adobe Campaign (same vendor)
CVE-2026-48356 – Adobe Commerce And Magento (same vendor)

Adobe: 83 known exploited vulnerabilities (CISA KEV) →

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.