CVE-2026-48321 is a critical incorrect authorization flaw (CVSS 9.3) in Adobe ColdFusion that could let an attacker gain unauthorized read and write access. The vulnerable component is restricted to an administrative network zone by default. Apply the updates in Adobe bulletin APSB26-82 for your release line.
What's affected
Adobe ColdFusion. The record names the product but not version numbers, and the Adobe bulletin page did not load for our review, so read APSB26-82 for the exact affected versions and the update that fixes each release line.
The record describes privilege escalation to unauthorized read and write access, with no privileges and no user interaction needed, over the adjacent network. The scope is changed.
How to check if you're exposed
Open the ColdFusion Administrator and look at the Server Update section to see the update level you run, then compare it with the fixed update named in Adobe bulletin APSB26-82. Also confirm which network can reach the Administrator and other internal ports.
What to do now
- Read APSB26-82 and find the fixed update for your release line.
- Apply it to every ColdFusion server, including standby and disaster recovery nodes.
- Check that the administrative zone is not reachable from user networks.
- Review what data and file locations the ColdFusion service can read and write, and trim that access.
Why it matters
The class is CWE-863, incorrect authorization. The application checks who you are but then gets the decision about what you may do wrong. The result in the record is read and write access the caller should not have.
The default administrative network zone is the main limit on exposure. That makes network placement part of the fix: confirm the zone is real in your environment. The record does not say this CVE is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-48321 is a handy place to follow later updates.
Quick check
What does a changed scope mean?
It means a successful attack can affect resources beyond the component that is vulnerable, which raises the score.
Sources
Last reviewed: 19 October 2026.
