CVE-2026-48282
Act now ● On CISA KEV — actively exploited
Actively exploited — on the CISA KEV list.
CVSS base
10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
42.4%
98.6th percentile
CISA KEV
Listed
Added 2026-07-07 · patch by 2026-07-10
Weakness / dates
CWE-22
Published 2026-06-30 · modified 2026-08-28
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | C | Changed |
| Confidentiality | H | High |
| Integrity | H | High |
| Availability | H | High |
Timeline
- 2026-06-30 — Published (NVD)
- 2026-07-07 — Added to CISA KEV (actively exploited)
- 2026-07-10 — CISA patch-by deadline
- 2026-08-28 — Last modified (NVD)
Description
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.