CVE-2026-48440

HighCVSS 8.1/10Last modified Aug 28, 2026

Description

ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
Adobe	ColdFusion 2025	<= 2025.0.11
Adobe	ColdFusion 2023	<= 2023.0.22

References

https://helpx.adobe.com/security/products/coldfusion/apsb26-90.htmlVendor Advisory

Timeline

Published: Aug 11, 2026
Last modified: Aug 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-484418.6Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could CVE-2026-484427.1CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that CVE-2026-484436.2CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. CVE-2026-484446.2CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service CVE-2026-484456.2CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service CVE-2026-484465.5CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that CVE-2026-484477.7Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of th CVE-2026-484488.6Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab CVE-2026-484499.8Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the co CVE-2026-48454.3A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is an unknown function of the file /admin/Member/index.html. This manipul CVE-2026-48464.3A vulnerability has been found in dameng100 muucmf 1.9.5.20260309. The affected element is an unknown function of the file channel/admin.Acc CVE-2026-48474.3A vulnerability was found in dameng100 muucmf 1.9.5.20260309. The impacted element is an unknown function of the file /admin/config/list.htm