Our takeTwo new critical ColdFusion CVEs (48321, 48327): incorrect authorization, no user interaction needed. One gives privilege escalation, the other arbitrary code execution as the current user. If you run ColdFusion, patch status matters more than the CVSS number — check Adobe's advisory before assuming you're covered.Cyber Resilience desk
Sources (8)
- adobe_patch · adobe_patch
- cccs · cccs
- nvd_recent · nvd_recent
- nvd_recent · nvd_recent
- nvd_recent · nvd_recent
- nvd_recent · nvd_recent
- hackernews · hackernews
- cccs · cccs
What this means for you — Security leader:Inventory all ColdFusion instances and check versions against Adobe's advisory for CVE-2026-48321 and CVE-2026-48327; both allow privilege escalation/code execution with no user interaction, so prioritize internet-facing servers for patching or isolation now.
What this means for you — Lean IT orgs:If you or a vendor runs Adobe ColdFusion for a website or internal app, get it patched to the latest version this week — these bugs let an attacker take over the server without tricking anyone into clicking anything.
What this means for you — MSP:Flag every client running ColdFusion, confirm patch level against the two new CVEs, and push updates to internet-facing instances first since exploitation requires no user interaction and scope is changed.
What this means for you — Researcher:Both CVEs are incorrect-authorization issues with scope change and no user interaction — worth diffing the patch to see if they share a root cause or auth-check bypass pattern across ColdFusion's admin/API layer.