Adobe ColdFusion CVE-2026-48362: An Unauthenticated CVSS 10.0 Command Injection — Patch Before the Scanners Find You

Adobe just patched an unauthenticated, CVSS 10.0 OS command injection in ColdFusion — CVE-2026-48362 — that gives a remote attacker full command execution on the server with no login, no user interaction, and low complexity. If you run an internet-facing ColdFusion server, this is a drop-everything patch. ColdFusion has a long, ugly history of critical RCEs getting weaponised within days of disclosure, and an unauthenticated perfect-10 is exactly the kind attackers race to exploit. Here’s what it is, how to tell whether you’re exposed, and what to do.

What the bug is

CVE-2026-48362 is an OS command injection flaw rated CVSS 10.0 — the maximum. It stems from improper neutralisation of special elements in an operating-system command: somewhere in ColdFusion, attacker-controlled input reaches a system command without being sanitised, so an attacker can smuggle their own commands into it. Because it’s unauthenticated and remote, anyone who can reach the server over the network can run arbitrary OS commands as the ColdFusion service account. On an internet-exposed box, that’s an immediate path to full host takeover.

It was disclosed as one of three CVSS 10.0 flaws Adobe fixed across ColdFusion and Campaign Classic, remediated in Adobe Security Bulletin APSB26-90. (Note: as of August 2026 Adobe sometimes assigns a single CVE to multiple internally-found issues that share a severity and weakness class, so this ID may cover a systemic fix rather than one isolated bug.)

Why ColdFusion command injection is game over

OS command injection is one of the most severe web vulnerability classes precisely because it skips every layer of the application. There’s no need to find an upload, chain a deserialization gadget, or pivot through the database — the attacker’s input becomes a shell command directly. The first thing an attacker does with it is drop a web shell (a .cfm file that executes commands on demand), giving them persistent, interactive control that survives the initial exploit. From there it’s credential theft, lateral movement, and data exfiltration. ColdFusion servers are a favourite target for exactly this reason: the payoff is a shell, fast.

Affected versions

• ColdFusion 2025 — vulnerable through 2025.0.11; fixed in 2025.0.12
• ColdFusion 2023 — vulnerable through 2023.0.22; fixed in 2023.0.23

Older, out-of-support ColdFusion releases should be assumed vulnerable and, frankly, retired.

How to tell if you’re even running ColdFusion (and if it’s exposed)

A surprising number of organisations don’t realise they have a ColdFusion server on the internet — it’s often a legacy app nobody owns anymore. Attackers find these boxes by fingerprinting, and you should audit your own estate the same way. The tells:

• Session cookies are the giveaway. ColdFusion sets CFID and CFTOKEN cookies (and often CFAUTHORIZATION). Because it runs on a Java engine, you’ll usually also see JSESSIONID. Seeing Set-Cookie: CFID=…; CFTOKEN=… in a response is a near-certain ColdFusion fingerprint.
• File extensions: pages ending in .cfm, .cfc, or .cfml (a homepage at index.cfm is a dead giveaway).
• The /CFIDE/ path — ColdFusion’s built-in directory. Most critically, the admin console at /CFIDE/administrator/index.cfm and script resources under /cf_scripts/. If /CFIDE/administrator/ is reachable from the internet, that’s a serious problem on its own, patch or no patch.
• Headers: the Server: header is usually generic (IIS or Apache sits in front), but X-Powered-By occasionally leaks the platform, and ColdFusion error pages spill Java stack traces referencing coldfusion.* classes.

A quick self-check: curl -sI https://your-host/ | grep -i 'CFID|CFTOKEN|X-Powered', and try requesting a .cfm path and /CFIDE/administrator/. If any of those respond, you’re running ColdFusion — inventory it and prioritise it.

What to do now

1. Patch to 2025.0.12 or 2023.0.23 immediately per Adobe APSB26-90. For an unauthenticated CVSS 10.0, “next maintenance window” is the wrong answer.
2. Get ColdFusion off the public internet if it doesn’t need to be there. Many ColdFusion apps are internal tools that were never meant to be internet-facing. If yours is exposed, ask whether it needs to be — network isolation is the strongest mitigation while you patch.
3. Lock down /CFIDE/ and the administrator console. Restrict access to the admin path by IP, and never expose /CFIDE/administrator/ to the internet. This is good hygiene independent of this specific CVE.
4. Put a WAF in front as a stopgap if you truly cannot patch at once — but treat it as a speed bump, not a fix. Command-injection payloads have many encodings.
5. Hunt for compromise. ColdFusion servers are prime web-shell targets. Look for unexpected .cfm/.cfc files with recent timestamps (especially under the web root and /CFIDE/), unusual child processes spawned by the ColdFusion service, and outbound connections you can’t explain. If the box was internet-facing and unpatched for any window, assume it may have been probed.

The bigger pattern

ColdFusion keeps producing these because of what it is: mature enterprise middleware running critical apps at governments, banks, and large organisations — often years past the attention it deserves, frequently internet-exposed, and rarely inventoried well. The lesson beyond this one CVE is to know your ColdFusion footprint before an attacker maps it for you. Scan your own external surface for the fingerprints above, retire what you don’t need, isolate what you do, and keep the ones that matter fully patched. An unauthenticated command-injection on legacy middleware is not a bug you get to sit on.

The bottom line

CVE-2026-48362 is an unauthenticated, CVSS 10.0 command injection that turns any reachable ColdFusion server into a shell for whoever finds it first. Patch to 2025.0.12 / 2023.0.23 today, pull ColdFusion off the public internet where you can, lock down /CFIDE/, and hunt for web shells on anything that was exposed. The fix is straightforward; the danger is not knowing you had ColdFusion facing the internet at all.

---

Sources: Adobe Security Bulletin APSB26-90 · The Hacker News · SecurityWeek. Confirm affected builds and the exact fixed version for your deployment in the Adobe bulletin before acting.