Adobe has disclosed a critical eval injection vulnerability in ColdFusion 2023 and 2025 that lets an attacker holding low-level privileges execute arbitrary code across a security boundary, with no user interaction required.
What Is It
CVE-2026-48273 is an Improper Neutralization of Directives in Dynamically Evaluated Code, "Eval Injection," tracked as CWE-95, in Adobe ColdFusion. Per Adobe's PSIRT description, the flaw "could result in arbitrary code execution in the context of the current user." A low-privileged attacker can exploit it to run arbitrary code, and exploitation does not require user interaction. Adobe explicitly notes that scope is changed, meaning the impact reaches beyond the vulnerable component's own security authority.
The CVE was published on 2026-09-08 by Adobe's PSIRT ([email protected]) and currently sits in NVD as "Awaiting Analysis."
Why It Matters
Adobe scores this at CVSS 3.1 base 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That breaks down to network attack vector, low attack complexity, only low privileges required, no user interaction, changed scope, and high impact to confidentiality, integrity, and availability alike. The 9.9 is the practical ceiling for a bug that still requires some level of authentication; the exploitability subscore is 3.1 against an impact subscore of 6.0.
ColdFusion application servers are typically internet-reachable and often hold or front sensitive business data, which is what makes a low-privilege-to-full-code-execution path on this platform consequential.
Exploitation status for this CVE is not addressed by Adobe's advisory or the NVD record. Defenders who need to know whether federal remediation timelines apply should check the CISA Known Exploited Vulnerabilities catalog directly, since its contents change on CISA's schedule rather than the vendor's.
What's Vulnerable
Per Adobe's affected-product data:
- ColdFusion 2025: Update 12 and earlier are affected. Update 13 is unaffected.
- ColdFusion 2023: Update 23 and earlier are affected. Update 24 is unaffected.
No CPE matches have been published in NVD yet.
Patch Status
Fixed releases exist. Move ColdFusion 2025 to Update 13 and ColdFusion 2023 to Update 24. Adobe's advisory APSB26-119 is the authoritative source for update packages and installation guidance.
Sources
- Adobe Security Bulletin APSB26-119; https://helpx.adobe.com/security/products/coldfusion/apsb26-119.html
- NVD, CVE-2026-48273, https://nvd.nist.gov/vuln/detail/CVE-2026-48273
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog