CVE-2026-48364: Adobe ColdFusion RCE Vulnerability

CVE-2026-48364 Overview

Adobe ColdFusion versions 2025.9, 2023.20, and earlier contain an Uncontrolled Search Path Element vulnerability [CWE-427]. An attacker can leverage this flaw to achieve arbitrary code execution in the context of the current user. Exploitation requires local access, low privileges, and user interaction — a victim must open a malicious file for the attack to succeed. The scope is changed, meaning successful exploitation impacts resources beyond the vulnerable component's security boundary. Adobe published corresponding fixes in security bulletin APSB26-68.

Critical Impact
Successful exploitation allows arbitrary code execution in the current user's context, with a scope change that can affect resources outside ColdFusion's security boundary.

Affected Products

Adobe ColdFusion 2025 (base release through Update 9)
Adobe ColdFusion 2023 (base release through Update 20)
Earlier ColdFusion releases inheriting the vulnerable search path handling

Discovery Timeline

2026-07-13 - CVE-2026-48364 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48364

Vulnerability Analysis

The flaw is classified as an Uncontrolled Search Path Element weakness [CWE-427]. ColdFusion resolves libraries or supporting files using a search path that includes locations an attacker can influence. When a victim opens a malicious file, ColdFusion loads attacker-controlled code from a path that takes precedence over the intended trusted location. Code then executes with the privileges of the invoking user. Because the CVSS scope is changed, execution can pivot into components governed by a different security authority, expanding the blast radius beyond the ColdFusion process itself.

Root Cause

ColdFusion trusts a search path that includes writable or attacker-influenced directories when locating dependencies. The runtime does not enforce a fully qualified or integrity-verified lookup, so a planted library or resource is loaded in preference to the legitimate file. This class of weakness is typically exploited through DLL preloading, side-loading, or ancillary configuration files placed alongside a lure document.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted file — for example through email, a network share, or a compressed archive — that is designed to be opened with ColdFusion tooling. When the victim opens the file, ColdFusion resolves a dependency from the attacker-controlled directory and executes the planted payload. Exploitation is not remote and does not target internet-exposed ColdFusion servers directly; it targets endpoints where ColdFusion components are installed and used interactively.

No public proof-of-concept exploit is currently available for CVE-2026-48364, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Adobe ColdFusion Security Advisory (APSB26-68) for vendor-supplied technical details.

Detection Methods for CVE-2026-48364

Indicators of Compromise

Unexpected DLL, JAR, or configuration files appearing in ColdFusion installation, working, or user profile directories.
ColdFusion processes spawning unusual child processes such as cmd.exe, powershell.exe, or scripting hosts shortly after a user opens a file.
File creation events in directories that fall within ColdFusion's library search path but are writable by standard users.
Outbound network connections initiated by ColdFusion processes to unfamiliar hosts following document-open events.

Detection Strategies

Monitor process creation events where the parent is a ColdFusion binary and the child is an interpreter, shell, or LOLBin.
Baseline the legitimate set of libraries loaded by ColdFusion and alert on module loads originating from non-standard paths.
Alert on file writes to ColdFusion program directories by non-installer or non-administrator accounts.

Monitoring Recommendations

Enable module and image load telemetry (for example, Sysmon Event ID 7) on hosts running ColdFusion tooling.
Correlate user file-open activity with subsequent process and network events initiated by ColdFusion.
Review endpoint logs for writes to writable directories that appear in the ColdFusion runtime search path.

How to Mitigate CVE-2026-48364

Immediate Actions Required

Apply the updates referenced in Adobe security bulletin APSB26-68 to all ColdFusion 2025 and 2023 installations.
Inventory endpoints and servers running ColdFusion to confirm patch coverage across every update level.
Instruct users to avoid opening ColdFusion-associated files from untrusted sources until patches are deployed.

Patch Information

Adobe addressed CVE-2026-48364 in the security update published as APSB26-68. Administrators must upgrade beyond ColdFusion 2025.9 and 2023.20 to a fixed release. Consult the vendor advisory for exact fixed build numbers and platform-specific installer guidance.

Workarounds

Remove write permissions on any directory that appears in ColdFusion's library or module search path for non-administrative users.
Restrict interactive use of ColdFusion tooling to accounts with the minimum privileges required.
Block delivery of ColdFusion-associated file types at email and web gateways from external senders where feasible.

bash

# Example: audit non-admin writable directories referenced by ColdFusion (Windows, PowerShell)
Get-ChildItem 'C:\ColdFusion2025','C:\ColdFusion2023' -Recurse -Directory |
  ForEach-Object {
    $acl = Get-Acl $_.FullName
    $acl.Access | Where-Object {
      $_.IdentityReference -match 'Users|Everyone|Authenticated Users' -and
      $_.FileSystemRights -match 'Write|Modify|FullControl'
    } | Select-Object @{n='Path';e={$_.FullName}}, IdentityReference, FileSystemRights
  }