Advisories · Technology

Adobe ColdFusion 2023.

Every CVE that names Adobe ColdFusion 2023 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-48327 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 14 Jul 2026
CVE-2026-48338 CVE record

CVSS 6.8 Medium

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Path traversal
Not analysed yet 14 Jul 2026
CVE-2026-48329 CVE record

CVSS 2.7 Low

ColdFusion | Insufficient Session Expiration (CWE-613)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Authentication bypass
Not analysed yet 14 Jul 2026
CVE-2026-48319 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Path traversal
Not analysed yet 14 Jul 2026
CVE-2026-48321 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 14 Jul 2026
CVE-2026-48322 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Code injection
Not analysed yet 14 Jul 2026
CVE-2026-48284 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 14 Jul 2026
CVE-2026-48328 CVE record

CVSS 7.7 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 14 Jul 2026
CVE-2026-48325 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

ColdFusion | Missing Authentication for Critical Function (CWE-306)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Authentication bypass
Not analysed yet 14 Jul 2026
CVE-2026-48363 CVE record

CVSS 8.2 High

ColdFusion | Uncontrolled Search Path Element (CWE-427)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-427
Not analysed yet 13 Jul 2026
CVE-2026-48364 CVE record

CVSS 8.2 High

ColdFusion | Uncontrolled Search Path Element (CWE-427)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-427
Not analysed yet 13 Jul 2026
CVE-2026-48316 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 6 Jul 2026
CVE-2026-48315 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 30 Jun 2026
CVE-2026-48281 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 30 Jun 2026
CVE-2026-48277 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 30 Jun 2026
CVE-2026-48285 CVE record

CVSS 8.6 High

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
CVE-2026-48313 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Path traversal
Not analysed yet 30 Jun 2026
CVE-2026-48307 CVE record

CVSS 8.8 High

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Cross-site scripting (XSS)
Not analysed yet 30 Jun 2026
CVE-2026-48314 CVE record

CVSS 6.5 Medium

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Path traversal
Not analysed yet 30 Jun 2026
CVE-2026-48276 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Unrestricted file upload
Not analysed yet 30 Jun 2026
CVE-2026-48282 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Path traversal
Not analysed yet 30 Jun 2026
CVE-2026-48283 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Unrestricted file upload
Not analysed yet 30 Jun 2026
CVE-2026-47929 CVE record

CVSS 8.4 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Broken access control
Not analysed yet 9 Jun 2026
CVE-2026-47932 CVE record

CVSS 8.8 High

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Path traversal
Not analysed yet 9 Jun 2026
CVE-2026-47960 CVE record

CVSS 7.4 High

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- XML external entities (XXE)
Not analysed yet 9 Jun 2026
CVE-2026-47928 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 9 Jun 2026
CVE-2026-47931 CVE record

CVSS 8.4 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 9 Jun 2026
CVE-2026-47930 CVE record

CVSS 8.1 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 9 Jun 2026
CVE-2026-47933 CVE record

CVSS 4.8 Medium

ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Cross-site scripting (XSS)
Not analysed yet 9 Jun 2026
CVE-2026-34619 CVE record

CVSS 7.7 High

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Path traversal
Not analysed yet 14 Apr 2026
CVE-2026-27308 CVE record

CVSS 2.4 Low

ColdFusion | Uncontrolled Resource Consumption (CWE-400)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Denial of service
Not analysed yet 14 Apr 2026
CVE-2026-27282 CVE record

CVSS 7.5 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 14 Apr 2026
CVE-2026-27305 CVE record

CVSS 8.6 HighCritical · CVSS 7+ and EPSS

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Path traversal
Not analysed yet 14 Apr 2026
CVE-2026-27304 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 14 Apr 2026
CVE-2026-27306 CVE record

CVSS 8.4 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- CWE-20
Not analysed yet 14 Apr 2026
CVE-2026-27307 CVE record

CVSS 2.4 Low

ColdFusion | Uncontrolled Resource Consumption (CWE-400)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Denial of service
Not analysed yet 14 Apr 2026