HIGH CWE-918
CVE-2026-48285
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
Adobe·ColdFusion 2025
8.6/ 10
CVSS 3.1
High severity
0.83%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 58% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Jun 30, 2026
- Updated
- Aug 27, 2026
- First covered
- Jul 3, 2026
- Latest story
- 4 months ago
Summary
ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.
CWE-918Server-Side Request Forgery (SSRF) (CWE-918)
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NAffected products
- Adobe ColdFusion 2025up to 9
- Adobe ColdFusion 2023up to 20