Unrated

Improper Input Validation RCE in Adobe ColdFusion

IdentifiersCVE-2026-48316CWE-20

CVE-2026-48316 is a critical improper input validation vulnerability in Adobe ColdFusion. Available reporting consistently identifies it as a CWE-20 issue affecting Adobe ColdFusion 2025 Update 9 and earlier and Adobe ColdFusion 2023 Update 20 and earlier. The flaw is one of several maximum-severity ColdFusion vulnerabilities addressed by Adobe in APSB26-68, and successful exploitation could lead to arbitrary code execution. The specific vulnerable function or code path is not provided in the available content.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation could allow arbitrary code execution on the affected ColdFusion server. Given the product context, this can result in full compromise of the application server, execution of attacker-supplied payloads, and follow-on actions in the security context of the ColdFusion service.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, Adobe recommends applying ColdFusion hardening guidance, including using the latest supported JDK/JRE LTS release, using the latest MySQL Java connector, applying ColdFusion security configuration settings and Lockdown Guide recommendations, and for JEE deployments configuring the documented JVM serial filter (-Djdk.serialFilter= !org.mozilla.;!com.sun.syndication.;!org.apache.commons.beanutils.;!org.jgroups.;!com.sun.rowset.; !com.mysql.cj.jdbc.interceptors.;!org.apache.commons.collections.**) in the application server startup configuration. These measures are compensating controls and not substitutes for patching.

Remediation

Patch, then assume compromise.

Upgrade Adobe ColdFusion 2025 to Update 10 and Adobe ColdFusion 2023 to Update 21, as identified by Adobe in APSB26-68.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

security affairsNews

Jul 2, 2026

Adobe fixed multiple maximum-severity flaws in ColdFusion and Campaign Classic - Security Affairs

A maximum-severity Adobe ColdFusion input validation vulnerability that could allow arbitrary code execution.

the hacker newsNews

Jul 1, 2026

Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic

An improper input validation vulnerability in Adobe ColdFusion that could lead to arbitrary code execution.

socradar blogNews

Jul 1, 2026

Adobe ColdFusion and Campaign Classic: Critical RCE Flaws Among Multiple CVSS 10.0 Issues

A critical Adobe ColdFusion improper input validation vulnerability with CVSS 10.0 that can lead to remote code execution.

cyber security newsNews

Jul 1, 2026

Critical Multiple Adobe ColdFusion Vulnerabilities Enables Arbitrary Code Execution Attacks

A critical improper input validation vulnerability in Adobe ColdFusion that enables arbitrary code execution.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-48316

NVD

nvd.nist.gov/vuln/detail/CVE-2026-48316

MITRE CWE · CWE-20

cwe.mitre.org