CVE-2026-48364

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.9 and earlier ColdFusion versions 2023.20 and earlier

Description An Uncontrolled Search Path Element issue exists that could allow arbitrary code execution in the context of the current user. This occurs when the application searches for a file in an uncontrolled directory, potentially loading a malicious library. Exploitation requires user interaction, specifically that a victim opens a malicious file.

Recommendations Update ColdFusion versions 2025.9 and earlier to a newer version. Update ColdFusion versions 2023.20 and earlier to a newer version.