Adobe ColdFusion contains a critical improper input validation vulnerability that can lead to arbitrary code execution without user interaction.
What Is It
CVE-2026-47928 is an Improper Input Validation flaw (CWE-20) in Adobe ColdFusion. According to Adobe's advisory, the vulnerability could result in arbitrary code execution in the context of the current user. Exploitation does not require user interaction. The issue carries a CVSS 3.1 base score of 9.6 (CRITICAL), with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The attack vector is adjacent network, attack complexity is low, no privileges are required, and the scope is changed; meaning a successful exploit can affect resources beyond the vulnerable component.
Why It Matters
A code-execution flaw requiring no privileges and no user interaction gives an adjacent-network attacker a direct path to running arbitrary code on affected ColdFusion servers. The changed scope and high confidentiality, integrity, and availability impacts indicate that a compromise could extend beyond ColdFusion itself, putting connected resources at risk. The 9.6 score reflects the seriousness of the exposure.
What's Vulnerable
Adobe ColdFusion versions 2023.19, 2025.8, and earlier are affected, per the NVD record. No specific affected CPE configurations were enumerated in the supplied data.
Patch Status
This CVE was published on 2026-06-09 with a vulnerability status of "Received." Adobe has issued security bulletin APSB26-64 covering this issue; administrators should consult that advisory and apply the vendor-provided updates to affected ColdFusion installations. The supplied data contains no CISA KEV entry, so there is no confirmation of active exploitation at this time.
Sources
- Adobe Security Bulletin APSB26-64; https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html
- NVD, CVE-2026-47928, https://nvd.nist.gov/vuln/detail/CVE-2026-47928