CVE-2026-48276

CRITICAL

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-48276. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-48276, an unrestricted file upload vulnerability in Adobe ColdFusion versions 2025.9, 2023.20, and earlier. The code includes placeholder methods (`check()` and `run()`) but lacks actual exploit implementation or technical details about the vulnerability mechanics.

Description

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Exploits (1)

github STUB 1 stars

by HermesNA-1 · pythonpoc

https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-48276_coldfusion_versions_20259.py

View Code ZIP pw:eip

This repository contains an auto-generated stub module for CVE-2026-48276, an unrestricted file upload vulnerability in Adobe ColdFusion versions 2025.9, 2023.20, and earlier. The code includes placeholder methods (`check()` and `run()`) but lacks actual exploit implementation or technical details about the vulnerability mechanics.

Classification

Stub 99%

Attack Type

Rce

Complexity

Moderate

Reliability

Theoretical

Target: Adobe ColdFusion versions 2025.9, 2023.20 and earlier

No auth needed

Prerequisites: Network access to the target ColdFusion server · Vulnerable version of ColdFusion (2025.9, 2023.20, or earlier)

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html

Scores

CVSS v3 10.0

EPSS 0.0092

EPSS Percentile 56.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-434

Status published

Products (3)

adobe/coldfusion 2023 (21 CPE variants)

adobe/coldfusion 2025 (10 CPE variants)

Adobe/ColdFusion < 2023.20

Published Jun 30, 2026

Tracked Since Jun 30, 2026