CVE-2026-48364 Adobe CVE debrief

Who should care

Administrators and users of ColdFusion versions 2025.9, 2023.20 and earlier should be aware of this Uncontrolled Search Path Element vulnerability. They should inventory and verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Technical summary

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability. This vulnerability could result in arbitrary code execution in the context of the current user if a victim opens a malicious file. The vulnerability requires user interaction and has a high CVSS score of 8.2. Affected product deployments should be inventoried and verified for exposure. Defenders should review official advisories and track exceptions for remediated assets. Administrators and users should be aware of this vulnerability and take necessary precautions to prevent exploitation.

Defensive priority

High priority due to the potential for arbitrary code execution.

Recommended defensive actions

• Inventory and verify ColdFusion versions 2025.9, 2023.20 and earlier.
• Apply vendor remediation when available.
• Implement compensating controls, such as monitoring and exception tracking.
• Educate users about the risks of opening malicious files.
• Review and track exceptions for remediated assets.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

Evidence is limited; verify with official vendor sources. The CVE record and NVD entry provide initial details. Affected product deployments should be inventoried and verified for exposure. Defenders should review official advisories and track exceptions for remediated assets.

Official resources