What is CVE-2026-48276?

CVE-2026-48276 is a critical-severity vulnerability in Adobe Coldfusion, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 10.0/10. Published 2026-06-30.

How severe is CVE-2026-48276?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Arbitrary file upload in Adobe Coldfusion

CVE-2026-48276

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue d…

Vulnerability class: Unrestricted File Upload

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Adobe Coldfusion — versions 2023, 0, 2025

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

psirt@adobe.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2026-48276?: CVE-2026-48276 is a critical-severity vulnerability in Adobe Coldfusion, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 10.0/10. Published 2026-06-30.
How severe is CVE-2026-48276?: Critical severity. CVSS v3 base score is 10.0 out of 10.