Cyber Resilience

CVE-2026-48276

Critical

Published: 30 June 2026

Published
30 June 2026
Modified
01 July 2026
KEV Added
Patch
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0092 55.8th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-48276 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Adobe Coldfusion. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user…

more

interaction. Scope is changed.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

Unrestricted upload of dangerous file type in public-facing ColdFusion server directly enables web shell deployment for arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-61808Same product: Adobe Coldfusion
CVE-2026-48283Same product: Adobe Coldfusion
CVE-2018-15961Same product: Adobe Coldfusion
CVE-2022-35712Same product: Adobe Coldfusion
CVE-2022-35690Same product: Adobe Coldfusion
CVE-2021-21087Same product: Adobe Coldfusion
CVE-2022-38418Same product: Adobe Coldfusion
CVE-2022-35710Same product: Adobe Coldfusion
CVE-2022-35711Same product: Adobe Coldfusion
CVE-2022-38419Same product: Adobe Coldfusion

Affected Assets

adobe
coldfusion
2023, 2025

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-434

Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.

addresses: CWE-434

Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.

addresses: CWE-434

Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.

addresses: CWE-434

Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.

References