CVE-2026-48319 is a critical path traversal flaw (CVSS 9.1) in Adobe ColdFusion. An attacker with high privileges could use it to execute arbitrary code as the current user, with no user interaction. Adobe's bulletin APSB26-82 lists the fixed updates, so find your release line there and apply the update.
What's affected
Adobe ColdFusion. The record names the product but not version numbers, and the Adobe bulletin page did not load for our review, so read APSB26-82 for the exact affected versions and the update that fixes each release line.
The vector requires high privileges, a network attack path and low complexity. The scope is changed.
How to check if you're exposed
Open the ColdFusion Administrator and look at the Server Update section to see the update level you run, then compare it with the fixed update named in Adobe bulletin APSB26-82. Also confirm which network can reach the Administrator and other internal ports.
Because the attacker needs high privileges, also review who holds ColdFusion administrator access and whether those accounts use strong, unique credentials.
What to do now
- Read APSB26-82 and identify the fixed update for each ColdFusion release line you run.
- Apply the update across all environments.
- Review administrator accounts and remove any that are unused.
- Check that the ColdFusion service account has only the file system access it needs.
Why it matters
The class is CWE-22, improper limitation of a pathname to a restricted directory. Path handling code is meant to keep file access inside an intended folder. When it fails, a crafted path can reach files or locations outside it, and here the advisory ties that to code execution.
The high privilege requirement lowers the odds of exploitation by an outsider, but it does not remove the risk. Stolen or reused administrator credentials turn a high privilege flaw into a practical one. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-48319 is a handy place to follow later updates.
Quick check
If the attack needs high privileges, is it still critical?
The CVSS score reflects the impact and the changed scope. Treat it as urgent where administrator access could be obtained, and patch anyway.
Sources
Last reviewed: 19 October 2026.
