Loading vulnerability…
Arbitrary Code Execution in Adobe ColdFusion via Uncontrolled Search Path Element
CVE-2026-48364 is an Uncontrolled Search Path Element vulnerability in Adobe ColdFusion affecting versions 2025.9 and earlier and 2023.20 and earlier. The flaw can cause ColdFusion to resolve and load resources from an attacker-influenced search path, creating a condition in which opening a malicious file can trigger execution of attacker-controlled code. Successful exploitation results in arbitrary code execution in the security context of the current user. The vulnerability requires user interaction and has changed scope.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can lead to arbitrary code execution in the context of the current user. This can allow compromise of confidentiality, integrity, and availability available to that user account, including execution of malicious payloads, modification of accessible data, and disruption of application or system operations. Because the scope is changed, exploitation may also affect resources beyond the initially vulnerable component.
If you can’t patch tonight, do this now.
Until patches can be applied, reduce exposure by preventing users from opening untrusted or unsolicited files with workflows that invoke ColdFusion-related processing, limiting execution from user-writable locations, and restricting local user privileges to minimize the impact of code execution in the current user context. Additional hardening of application execution paths and software loading behavior may further reduce exploitability, but vendor-provided updates are the primary mitigation.
Patch, then assume compromise.
Upgrade Adobe ColdFusion to a fixed release newer than 2025.9 for the 2025 branch and newer than 2023.20 for the 2023 branch. Apply the vendor security update referenced by Adobe advisory APSB26-68 across all affected installations.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.