CVE-2026-48329

LOW

Adobe ColdFusion 2025 - ColdFusion | Insufficient Session Expiration (CWE-613)

Title source: rule

Description

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html

Scores

CVSS v3 2.7

EPSS 0.0030

EPSS Percentile 21.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-613

Status published

Products (6)

adobe/coldfusion 2023 (22 CPE variants)

adobe/coldfusion 2025 (11 CPE variants)

Adobe/ColdFusion 2023 < 21

Adobe/ColdFusion 2023 22

Adobe/ColdFusion 2025 < 10

Adobe/ColdFusion 2025 11

Published Jul 14, 2026

Tracked Since Jul 15, 2026