CVE-2026-48375 Overview
CVE-2026-48375 is an Incorrect Authorization vulnerability [CWE-863] in Adobe ColdFusion that enables a low-privileged, authenticated attacker to trigger an application denial-of-service. The flaw affects Adobe ColdFusion 2023 (through Update 22) and ColdFusion 2025 (through Update 11). Exploitation requires network access and valid low-privilege credentials but no user interaction. A successful attacker can crash the ColdFusion application, disrupting availability of hosted web services and business logic.
Critical Impact
Authenticated low-privileged attackers can crash Adobe ColdFusion over the network, producing an application-wide denial-of-service without user interaction.
Affected Products
- Adobe ColdFusion 2023 (base release through Update 22)
- Adobe ColdFusion 2025 (base release through Update 11)
- Deployments exposing the ColdFusion application to authenticated network users
Discovery Timeline
- 2026-08-11 - CVE-2026-48375 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-48375
Vulnerability Analysis
CVE-2026-48375 is classified as Incorrect Authorization [CWE-863]. ColdFusion fails to correctly enforce authorization checks on a code path reachable by users holding low-privilege accounts. When that path is invoked, the application enters an error state that terminates or crashes the ColdFusion process. Confidentiality and integrity are not affected; the impact is limited to availability. Because the attack vector is network-based and complexity is low, exploitation is straightforward once an attacker holds any authenticated foothold. The EPSS probability at publication was 0.576% (percentile 44.55), indicating no widespread exploitation activity has been observed.
Root Cause
The root cause is an authorization decision that does not correctly restrict which authenticated principals may invoke a sensitive operation. Instead of rejecting a low-privileged caller, ColdFusion permits the request and reaches code that fails unsafely, producing a crash. This pattern is consistent with missing role validation or improper trust of a request attribute during authorization evaluation.
Attack Vector
An attacker with valid low-privileged credentials sends a crafted request to the ColdFusion server over the network. Because the authorization check does not block the request, ColdFusion processes it and fails, halting the application. No user interaction is required, and the scope of the impact remains within the ColdFusion component. Adobe's advisory does not publish exploitation details. Refer to the Adobe ColdFusion Security Advisory APSB26-90 for vendor guidance.
Detection Methods for CVE-2026-48375
Indicators of Compromise
- Unexpected ColdFusion service crashes or JVM termination correlated with authenticated HTTP requests from non-administrative accounts.
- Repeated 5xx errors or connection resets on ColdFusion endpoints immediately preceding a service restart.
- Authentication events from low-privileged ColdFusion accounts followed by application unavailability.
Detection Strategies
- Monitor ColdFusion application logs (cfserver.log, exception.log) for stack traces and fatal errors tied to authenticated sessions.
- Alert on abnormal restart frequency of the ColdFusion Application Service or its JVM process.
- Correlate web access logs with authentication events to identify low-privileged users triggering server-side faults.
Monitoring Recommendations
- Ingest ColdFusion, web server, and OS process logs into a centralized SIEM for correlation across authentication, request, and crash events.
- Establish a baseline for ColdFusion process uptime and alert on deviations.
- Track authentication success from low-privilege accounts to sensitive administrative or reporting endpoints.
How to Mitigate CVE-2026-48375
Immediate Actions Required
- Apply the security updates listed in Adobe advisory APSB26-90 for ColdFusion 2023 and ColdFusion 2025.
- Inventory all ColdFusion instances and confirm their current update level against the affected version list.
- Review and reduce the number of low-privileged accounts with network access to ColdFusion.
- Restrict ColdFusion administrative and application interfaces to trusted network segments.
Patch Information
Adobe has published fixes in the Adobe ColdFusion Security Advisory APSB26-90. Administrators should upgrade ColdFusion 2023 and ColdFusion 2025 to the updates identified in that bulletin. Confirm patch application by checking the ColdFusion Administrator update page after installation and restarting the application service.
Workarounds
- Limit ColdFusion access to authenticated users on trusted networks using firewall or reverse-proxy allow-lists until patches are applied.
- Disable or lock unused low-privilege accounts on ColdFusion to reduce the attacker population.
- Deploy a web application firewall rule to rate-limit authenticated requests and detect repeated crash-inducing patterns.
# Example: restrict ColdFusion admin and application ports to trusted management network
# Replace 10.10.0.0/24 with your trusted CIDR and 8500 with your ColdFusion port
iptables -A INPUT -p tcp --dport 8500 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8500 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
