CVE-2026-48332

HighCVSS 7.7/10Last modified Aug 28, 2026

Description

ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
AdobeColdFusion 2025<= 10
AdobeColdFusion 2023<= 21

References

Timeline

Published
Jul 14, 2026
Last modified
Aug 28, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-483339.8Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker CVE-2026-483349.3Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the cuCVE-2026-483357.8Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current CVE-2026-483367.8Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current CVE-2026-483377.8Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current CVE-2026-483386.8ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead toCVE-2026-483397.8Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the currentCVE-2026-48347.5The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.CVE-2026-483407.8Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the curCVE-2026-483417.8Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-483427.8Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the cuCVE-2026-483437.8Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.
CVE-2026-48332: High severity, CVSS 7.7 | Vulnix