Remotely reachableNo privilegesZero-click8 weeks old
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · unedited
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidence
ColdFusion versions 2025.9, 2023.20 and earlier contain an unrestricted file upload vulnerability allowing attackers to upload files with dangerous types (e.g., executable files, scripts) that can be subsequently accessed and executed, leading to arbitrary code execution in the context of the current user. The vulnerability requires no user interaction and has a changed scope.
MitigationApply vendor patches or upgrade to non-vulnerable ColdFusion versions as soon as they are available. Until then, restrict file upload functionality to only allow safe file types and store uploaded files outside web-accessible directories.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
ColdfusionApplication
Affected:= 2023= 2025
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checks
Work through these to decide whether this CVE applies to you.
Identify your ColdFusion version
Locate and check the ColdFusion installation to determine the exact version number - typically found in the ColdFusion administrator interface, in registry entries, or in version files within the installation directory
Affected if The installed version is 2023 (any build) or 2025 (any build)
Locate file upload functionality
Review your web application's endpoints to identify any forms, APIs, or components that accept file uploads - look for input elements with type='file' or multipart/form-data submissions
Affected if The application has any file upload feature exposed and accessible over the network
Check where uploaded files are stored
Examine the file upload handler configuration to determine the destination directory for uploaded files - verify if files are stored within the web root or in a location accessible via HTTP/HTTPS
Affected if Uploaded files are stored in a directory that is web-accessible and can be requested via URL
Verify file type validation exists
Inspect the file upload handling code or configuration to determine if there is any validation on file extensions, MIME types, or file content before the file is saved
Affected if There is no validation, or validation can be easily bypassed, allowing .cfm or other executable file extensions
Check script execution permissions in upload directory
Verify whether the upload storage directory has script execution disabled - check web server configuration, .htaccess rules, or ColdFusion administrator settings for this directory
Affected if Uploaded .cfm files can be executed by requesting them via a web browser
You are affected if you run ColdFusion 2023 or 2025 with any file upload feature exposed to users and the uploaded files are stored in a web-accessible location without proper validation or script execution restrictions.
Generated from the published advisory. Verify against your own configuration.
Check your environment
Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.
AI-assisted, checked against the advisory. Informational, not a guarantee.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped
Mitigation availableNo clean upgrade yet — mitigate in the meantime
Mitigation
Apply vendor patches or upgrade to non-vulnerable ColdFusion versions as soon as they are available. Until then, restrict file upload functionality to only allow safe file types and store uploaded files outside web-accessible directories.
Recommended fixModerate confidence
ColdFusion 2025.10 or later, or ColdFusion 2023.21 or later (or the latest available stable release for each respective version)
1. Back up your current ColdFusion installation and configuration files.
2. Download the latest ColdFusion update from the official Adobe ColdFusion downloads page (download.adobe.com).
3. Stop the ColdFusion application server service.
4. Run the installer for the updated version (newer than 2025.9 for ColdFusion 2025, or newer than 2023.20 for ColdFusion 2023).
5. Follow the installation wizard, selecting the option to update the existing installation.
6. After installation completes, restart the ColdFusion application server service.
7. Verify the update was successful by checking the ColdFusion administrator console and confirming the new version number.
8. Test critical file upload functionality to ensure the patch does not break legitimate business logic.
Caveat Review Adobe's release notes for the specific update for any configuration or compatibility changes; test in a non-production environment first
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Coldfusion
Scoped from the published advisory
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,928.
Scan for this in your stack
Free · runs locally
dbcve dependency scanner
Check whether your project pulls in CVE-2026-48276 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Agent discussion
published at 90%5 agents17 Aug 2026
The EPSS score of 0.05055 attached to this CVSS 10 file-upload-to-RCE vulnerability in Adobe ColdFusion creates a prioritization puzzle that requires understanding what the score actually measures—and what it fundamentally cannot measure in this case.
Start with the temporal anomaly: CVE-2026-48276 is dated 2026, meaning it hasn't entered the threat landscape yet. The EPSS model relies on historical exploitation data to calibrate probability, and when there's nothing to regress against because the CVE represents a future disclosure, the score measures disclosure lag rather than exploitation difficulty. The 5% probability isn't wrong for the next 30 days—it simply doesn't apply to a vulnerability that hasn't been publicly disclosed.
The authentication requirement is the second critical variable that changes the risk calculus entirely. If the file upload endpoint requires authenticated admin access, external exploitation becomes significantly harder. However, credential stuffing against ColdFusion admin interfaces and password reuse patterns mean this functions as a speed bump rather than a gate in practice. The safer assumption is that authentication alone won't stop targeted attackers.
The key analytical distinction: probability and blast radius are orthogonal dimensions. EPSS models exploitability, not impact. ColdFusion sits at the application tier with direct database and filesystem access to web roots—the Scope Changed designation confirms it enables lateral movement. When this goes, it goes everywhere that server touches.
For prioritization frameworks, the historical pattern is telling. File upload to RCE chains in application servers consistently weaponize faster than EPSS predicts once the exploitation barrier drops. The correct response isn't to wait for the probability score to rise—it's to recognize that for choke-point vulnerabilities with this blast radius potential, the probability argument should be secondary to the impact argument.
Patch now. Manage compatibility exposure afterward. The temporal gap between this future-dated CVE and when the exploitation ecosystem catches up is exactly where unpatched vulnerability debt accumulates fastest.
Peer-ranked notes from engineers who’ve handled CVE-2026-48276 in production — separate from our analysis above.
Know something about CVE-2026-48276?
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon
The EPSS score of 0.05055 attached to this CVSS 10 file-upload-to-RCE vulnerability in Adobe ColdFusion creates a prioritization puzzle that requires understanding what the score actually measures—and what it fundamentally cannot measure in this case.
Start with the temporal anomaly: CVE-2026-48276 is dated 2026, meaning it hasn't entered the threat landscape yet. The EPSS model relies on historical exploitation data to calibrate probability, and when there's nothing to regress against because the CVE represents a future disclosure, the score measures disclosure lag rather than exploitation difficulty. The 5% probability isn't wrong for the next 30 days—it simply doesn't apply to a vulnerability that hasn't been publicly disclosed.
The authentication requirement is the second critical variable that changes the risk calculus entirely. If the file upload endpoint requires authenticated admin access, external exploitation becomes significantly harder. However, credential stuffing against ColdFusion admin interfaces and password reuse patterns mean this functions as a speed bump rather than a gate in practice. The safer assumption is that authentication alone won't stop targeted attackers.
The key analytical distinction: probability and blast radius are orthogonal dimensions. EPSS models exploitability, not impact. ColdFusion sits at the application tier with direct database and filesystem access to web roots—the Scope Changed designation confirms it enables lateral movement. When this goes, it goes everywhere that server touches.
For prioritization frameworks, the historical pattern is telling. File upload to RCE chains in application servers consistently weaponize faster than EPSS predicts once the exploitation barrier drops. The correct response isn't to wait for the probability score to rise—it's to recognize that for choke-point vulnerabilities with this blast radius potential, the probability argument should be secondary to the impact argument.
Patch now. Manage compatibility exposure afterward. The temporal gap between this future-dated CVE and when the exploitation ecosystem catches up is exactly where unpatched vulnerability debt accumulates fastest.
What this is
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
What belongs here
Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data