Loading vulnerability…
Arbitrary Code Execution in Adobe ColdFusion via Uncontrolled Search Path Element
CVE-2026-48363 is an Uncontrolled Search Path Element vulnerability in Adobe ColdFusion affecting versions 2025.9 and earlier and 2023.20 and earlier. The flaw can cause ColdFusion to resolve and load resources from an attacker-influenced search path, enabling execution of arbitrary code in the security context of the current user. Exploitation requires user interaction: a victim must open a malicious file. The vulnerability has changed scope, indicating compromise may extend beyond the initially vulnerable component.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in arbitrary code execution with the privileges of the current user running the affected ColdFusion-related process or application context. Given the changed scope and the assigned CVSS characteristics, exploitation may lead to high-impact compromise of confidentiality, integrity, and availability, including execution of attacker-controlled code and subsequent actions available to that user context.
If you can’t patch tonight, do this now.
Until patches can be applied, reduce exposure by preventing users from opening untrusted files associated with ColdFusion workflows, restricting local write locations and search-path influence where possible, and running affected software with the least privileges necessary so that arbitrary code execution occurs in a minimally privileged context. Additional compensating controls may include application allowlisting and endpoint protections that block suspicious file-based execution chains.
Patch, then assume compromise.
Upgrade Adobe ColdFusion to a fixed release newer than 2025.9 for the 2025 branch and newer than 2023.20 for the 2023 branch. Apply the vendor security update referenced in Adobe advisory APSB26-68 and ensure all affected installations are brought to a patched version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.