CVE-2026-48281: ColdFusion | Improper Input Validation (CWE-20)

Synopsis

Improper input validation in Adobe ColdFusion (versions 2023.20 and earlier, and 2025.9) allows a remote, unauthenticated attacker to execute arbitrary code on the server. The flaw is reachable over the network with no credentials and no victim interaction required, and the changed scope means the attacker can break out of the ColdFusion process and affect other components on the host. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable ColdFusion service must be reachable over the network; an attacker can send a malicious request from any internet-accessible position without needing LAN or physical proximity.

• AuthenticationNot required

  No credentials of any privilege level are needed; the exploit works against an unauthenticated endpoint.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; the exploit is entirely server-side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental setup.

Blast Radius

• Attacker executes arbitrary code in the context of the ColdFusion server process, with the ability to run OS commands, install backdoors, or exfiltrate data.
• Because scope is changed, the attacker can pivot beyond the ColdFusion process and read or tamper with other services, files, or credentials on the underlying host.
• All data accessible to the ColdFusion application, including session tokens, database credentials, and customer records, is exposed for reading.
• The attacker can modify or delete persisted application data and crash or indefinitely disrupt the ColdFusion service and dependent workloads.