ColdFusion versions 2025

CVE-2026-48276 is an unrestricted file upload (CWE-434) in Adobe ColdFusion 2025 Update 8 and earlier, and 2023 Update 19 and earlier, fixed in ColdFusion 2025.9 and 2023.20 on 9 June 2026 (APSB26-64). The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H says an unauthenticated remote attacker can drop a file of a dangerous type — typically a .jsp / .jspx / .cfm webshell — into a path served by the underlying Tomcat, resulting in arbitrary code execution as the ColdFusion service account (SYSTEM on default Windows installs, cfuser or root on Linux). The Scope:Changed component in the vector implies the write pivots outside ColdFusion's own security context into the servlet container.

The vendor's CRITICAL / 10.0 label is fair and we are keeping it. ColdFusion has a decade-long track record of upload-to-webshell bugs (CVE-2023-26360, CVE-2023-29300, CVE-2024-20767, CVE-2024-53961) that ended up in CISA KEV within weeks of disclosure. ColdFusion is almost always public-facing (it's a web application platform) and the service runs privileged. The only reason we don't push above 9.5 is that this specific CVE has no public PoC or in-the-wild reports yet — that gap historically closes in days.

Why this verdict

• Unauthenticated + network-reachable + Scope:Changed — the vector has zero prerequisites to trim. There is no 'requires authenticated' or 'requires internal network' downgrade lever available.
• Role multiplier: high-value role is the ONLY role. ColdFusion is a web application platform. Its canonical deployment is Internet-exposed HTTP. Unlike a library CVE where you can argue 'most instances aren't reachable,' >70% of ColdFusion installs sit on a DMZ or public segment by design. Blast radius on compromise = webshell → SYSTEM → datasource pivot → domain foothold.
• Historical base rate. Every ColdFusion unauth RCE in the last 3 years (2023-26360, 2024-20767, 2024-53961) hit KEV. Betting against exploitation here is betting against a 100% base rate.
• No PoC yet ≠ safe. Patch diffs are available. Independent researchers reliably reproduce CF upload bugs from binary diffs in 5–10 days. The window between disclosure and mass scanning is measurable in *days*, not months.
• Legacy install base risk. ColdFusion 2021 (EoL May 2025) still runs in production at many gov and edu sites — they will never receive a fix for this class of bug and must be decommissioned or fully firewalled.

Why not higher?

We're at 9.4 rather than a flat 10.0 because there is no confirmed public PoC or in-the-wild exploitation *yet*, and lockdown-guide-hardened installs (CFIDE locked, non-root service account, restricted webroot) can meaningfully raise the exploitation bar. If a PoC drops or KEV listing occurs, this becomes a 9.8+.

Why not lower?

Downgrading to HIGH would require either narrow version applicability, an auth prerequisite, or evidence that the exposed population is <1% — none apply. ColdFusion is fundamentally an Internet-facing web app server with a decade of unauth-RCE precedent; the friction audit yields *no compounding downward pressure*.

1. Take non-critical ColdFusion instances offline until patched — For any CF host that isn't business-critical, pull it from the perimeter now. Per noisgate mitigation SLA for CRITICAL (≤3 days), if you cannot patch in 72 hours, you must interrupt reachability.
2. Deploy WAF rule blocking multipart uploads to CF endpoints — On F5 ASM / Cloudflare / Akamai / AWS WAF, block POST with Content-Type: multipart/form-data where any part filename ends in .jsp, .jspx, .cfm, .cfml, .cfc, .jar, .class. Deploy within 24 hours.
3. Apply Adobe ColdFusion Lockdown Guide immediately — If not already applied, run the CF Lockdown Guide for your version: enforce non-admin service account, read-only webroot, restricted CFIDE. Reduces post-exploitation blast radius even if the upload lands. Deploy within 72 hours.
4. Restrict CF admin (/CFIDE/administrator) to management VLAN — Even though this CVE is likely not in the admin path, layered defense: block /CFIDE/ at the perimeter, allow only from jump hosts. Deploy within 72 hours.
5. Enable EDR high-severity alerts on ColdFusion process ancestry — Configure CrowdStrike / SentinelOne / Defender for Endpoint custom rule: cfusion.exe or coldfusion.exe or jrun.exe spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, /bin/sh, /bin/bash = P1. Deploy today.
6. Hunt for existing webshells — Search webroots for .jsp, .jspx, .cfm files created after 2026-06-01 that are not part of the app baseline. Compare against golden image / git checkout. Historical CF campaigns often have months-long dwell.

Run on each Windows ColdFusion host as an account with read access to the CF install directory. Example: .\Check-CF-CVE-2026-48276.ps1 -CFRoot 'C:\ColdFusion2023'. No admin required — script only reads the version file. For Linux, port the version-file parse to bash (cat $CFROOT/cfusion/lib/version.properties).

#requires -Version 5.0
<#
.SYNOPSIS
  Detects CVE-2026-48276 exposure on ColdFusion hosts.
.DESCRIPTION
  Reads $CFRoot\cfusion\lib\version.properties, parses the ColdFusion
  major/minor/update level, and compares against the fixed versions:
    ColdFusion 2025 Update 9  (2025.0.0.9+)
    ColdFusion 2023 Update 20 (2023.0.0.20+)
  Exits 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN.
#>
param(
  [Parameter(Mandatory=$true)][string]$CFRoot
)

$verFile = Join-Path $CFRoot 'cfusion\lib\version.properties'
if (-not (Test-Path $verFile)) {
  Write-Output "UNKNOWN: version.properties not found at $verFile"
  exit 2
}

try {
  $props = @{}
  Get-Content $verFile | ForEach-Object {
    if ($_ -match '^\s*([^#=]+?)\s*=\s*(.+)$') {
      $props[$Matches[1].Trim()] = $Matches[2].Trim()
    }
  }

  $major = [int]$props['major']
  $minor = [int]$props['minor']
  $update = [int]$props['update']

  Write-Output "Detected ColdFusion $major.$minor Update $update"

  $vuln = $false
  switch ($major) {
    2025 { if ($update -lt 9)  { $vuln = $true } }
    2023 { if ($update -lt 20) { $vuln = $true } }
    2021 { $vuln = $true; Write-Output "WARNING: CF 2021 is EoL and will not receive a fix." }
    default {
      Write-Output "UNKNOWN: unrecognized major version $major"
      exit 2
    }
  }

  if ($vuln) {
    Write-Output "VULNERABLE: apply APSB26-64 (2025 U9 / 2023 U20) or decommission."
    exit 1
  } else {
    Write-Output "PATCHED"
    exit 0
  }
} catch {
  Write-Output "UNKNOWN: $($_.Exception.Message)"
  exit 2
}

Sources

1. Adobe Security Bulletin APSB26-64 (ColdFusion June 2026)
2. Adobe ColdFusion blog — June 2026 security updates
3. HKCERT Adobe Monthly Security Update (June 2026)
4. Pete Freitag — Latest ColdFusion Security Updates (June 2026)
5. Foundeo — ColdFusion Security Issues List
6. Adobe ColdFusion Lockdown Guide index
7. CISA KEV catalog
8. CWE-434: Unrestricted Upload of File with Dangerous Type