CVE-2026-48277

CRITICAL

ColdFusion | Improper Input Validation (CWE-20)

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-48277. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-48277, a ColdFusion Improper Input Validation vulnerability leading to arbitrary code execution. The code includes placeholder methods (`check()` and `run()`) but lacks actual exploit implementation or technical details about the vulnerability mechanics.

Description

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Exploits (1)

github STUB 1 stars

by HermesNA-1 · pythonpoc

https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-48277_coldfusion_versions_20259.py

View Code ZIP pw:eip

This repository contains an auto-generated stub module for CVE-2026-48277, a ColdFusion Improper Input Validation vulnerability leading to arbitrary code execution. The code includes placeholder methods (`check()` and `run()`) but lacks actual exploit implementation or technical details about the vulnerability mechanics.

Classification

Stub 99%

Attack Type

Rce

Complexity

Moderate

Reliability

Theoretical

Target: Adobe ColdFusion versions 2025.9, 2023.20 and earlier

No auth needed

Prerequisites: Network access to the target ColdFusion server (default port 80/443) · Vulnerable ColdFusion version (2025.9, 2023.20 or earlier)

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html

Scores

CVSS v3 10.0

EPSS 0.0086

EPSS Percentile 54.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-20

Status published

Products (3)

adobe/coldfusion 2023 (21 CPE variants)

adobe/coldfusion 2025 (10 CPE variants)

Adobe/ColdFusion < 2023.20

Published Jun 30, 2026

Tracked Since Jun 30, 2026