CVE-2026-48322: Adobe ColdFusion RCE Vulnerability

CVE-2026-48322 Overview

Adobe ColdFusion contains a code injection vulnerability [CWE-94] that allows attackers to execute arbitrary code in the context of the current user. The flaw affects ColdFusion 2023 (updates through 21) and ColdFusion 2025 (updates through 10). Exploitation requires no user interaction and is achievable over the network with low attack complexity. The scope is changed, meaning successful exploitation impacts resources beyond the vulnerable component. Adobe published the fix in security bulletin APSB26-82.

Critical Impact
An authenticated attacker with low privileges can inject and execute arbitrary code remotely, compromising confidentiality, integrity, and availability of the ColdFusion server and connected systems.

Affected Products

Adobe ColdFusion 2023 (GA through Update 21)
Adobe ColdFusion 2025 (GA through Update 10)
Deployments running vulnerable ColdFusion Application Server instances

Discovery Timeline

2026-07-14 - CVE-2026-48322 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48322

Vulnerability Analysis

The vulnerability stems from improper control of code generation within ColdFusion request processing. An attacker who supplies crafted input can influence how the server generates or evaluates code, leading to arbitrary execution under the ColdFusion service account. Because the scope is changed, the executed code can reach resources outside the ColdFusion security boundary, including backend databases, file systems, and adjacent services.

Code injection flaws in ColdFusion historically target CFML expression evaluation, template compilation, and dynamic method invocation paths. Successful exploitation typically results in webshell deployment, credential theft, or lateral movement into internal networks.

Root Cause

The root cause is classified as CWE-94: Improper Control of Generation of Code (Code Injection). ColdFusion accepts attacker-influenced data into a code generation or evaluation routine without adequate sanitization, allowing the injected payload to be parsed as executable logic rather than inert data.

Attack Vector

The attack vector is network-based and requires low-privilege authentication to the ColdFusion instance. No user interaction is needed. An attacker submits a malicious request to a vulnerable endpoint, and the server processes the embedded payload as code during request handling. Given the changed scope, the impact extends to systems the ColdFusion process can reach.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is approximately 0.495 percent. See the Adobe ColdFusion Security Advisory (APSB26-82) for vendor technical details.

Detection Methods for CVE-2026-48322

Indicators of Compromise

Unexpected .cfm or .cfml files written to web-accessible directories, particularly outside standard application paths.
ColdFusion service process (coldfusion.exe, jrun.exe, or Java process) spawning child processes such as cmd.exe, powershell.exe, or /bin/sh.
Outbound network connections from the ColdFusion server to unfamiliar external IP addresses or command-and-control infrastructure.
Unusual entries in ColdFusion Administrator logs or scheduled task creation via CFML endpoints.

Detection Strategies

Monitor ColdFusion request logs for POST or GET traffic containing serialized objects, CFML tags, or expression evaluation syntax in unexpected parameters.
Deploy behavioral endpoint monitoring to identify anomalous process trees originating from the ColdFusion Java runtime.
Correlate authentication events with subsequent code execution attempts to isolate low-privilege accounts being weaponized.

Monitoring Recommendations

Enable ColdFusion debug and audit logging, then forward events to a centralized SIEM for correlation with network telemetry.
Alert on file writes to wwwroot, CFIDE, and template directories by the ColdFusion service account.
Track process creation events and outbound connections from ColdFusion hosts to catch post-exploitation activity early.

How to Mitigate CVE-2026-48322

Immediate Actions Required

Apply the security updates referenced in Adobe bulletin APSB26-82 to all ColdFusion 2023 and 2025 installations.
Inventory ColdFusion deployments and confirm patch level using the ColdFusion Administrator or version endpoint.
Rotate credentials for any low-privileged accounts with access to ColdFusion administrative or authenticated interfaces.
Restrict network access to ColdFusion Administrator and API endpoints to trusted management networks only.

Patch Information

Adobe released patched builds for ColdFusion 2023 and ColdFusion 2025 as documented in the Adobe ColdFusion Security Advisory (APSB26-82). Administrators should upgrade to the fixed update level for their respective version and verify installation via the ColdFusion Administrator update page.

Workarounds

Apply the ColdFusion lockdown guide to reduce the attack surface if patching must be delayed.
Place ColdFusion behind a web application firewall configured to block CFML injection patterns and serialized object payloads.
Enforce least privilege on the ColdFusion service account and disable unused features such as remote debugging.
Segment ColdFusion servers from sensitive backend systems to limit blast radius from scope-changing exploitation.

bash

# Example: restrict ColdFusion Administrator access via firewall (Linux/iptables)
iptables -A INPUT -p tcp --dport 8500 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8500 -j DROP

# Verify installed ColdFusion version and update level
curl -sk https://coldfusion.example.com/CFIDE/administrator/ | grep -i version