CVE-2026-47928 is an improper input validation flaw in Adobe ColdFusion that can lead to arbitrary code execution in the context of the current user. It is scored CVSS 9.6 (critical). Versions 2023.19, 2025.8 and earlier are affected. Adobe bulletin APSB26-64 lists the update, so confirm it there.
What's affected
The NVD record says ColdFusion versions 2023.19, 2025.8 and earlier are affected. It adds that the vulnerable component is restricted to an administrative network zone by default, that exploitation needs no user interaction, and that scope is changed.
The vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The A in AV:A means adjacent network, so the attacker must sit on the same network segment or reach the component through a path to it. That fits the record's note about the administrative zone.
Adobe's bulletin APSB26-64 is the only reference. It returned a 403 error when I fetched it, so I could not read the fixed update numbers and I will not state them. Open the bulletin to find them.
How to check if you're exposed
- Log in to the ColdFusion Administrator and read the version and update level shown for the server. Compare with the 2023.19 and 2025.8 figures above.
- For a scripted check, many teams record the ColdFusion version in their configuration management or container image tags. Check the image tag in your registry.
- Check network exposure of the administrative interface. By default it should be reachable only from an administrative zone, per the record.
- Open Adobe bulletin APSB26-64 and compare your update level with its fixed update.
If the administrative interface is reachable from user networks or the internet, treat that as a problem independent of this CVE.
What to do now
- Inventory every ColdFusion server and record its version and update level.
- Read Adobe bulletin APSB26-64 and apply the update it lists for your product line.
- Confirm the administrative interface is limited to an administrative network zone, as the record says is the default.
- Review firewall rules and reverse proxies in front of ColdFusion for paths into the admin zone.
- Restart the service after the update and recheck the version in the Administrator.
Why it matters
The weakness is CWE-20, improper input validation. It is a broad class: a component accepts data without checking that it is safe before using it. The record says the result can be arbitrary code execution as the current user.
The network condition changes how to rank the work. The record says the component is restricted to an administrative zone by default, so well segmented servers have a narrower exposure than the score alone suggests. That is a reason to patch and also to confirm segmentation. The record's KEV flag is false.
Quick check
Is CVE-2026-47928 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Does the 9.6 score mean it is open to the internet?
No. The vector says adjacent network, and the record says the component is restricted to an administrative network zone by default.
Sources
Last reviewed: 19 October 2026.
