ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the …

Adobe ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability tracked as CVE-2026-48281. The vulnerability can result in arbitrary code execution in the context of the current user. Notably, exploitation does not require user interaction, making it particularly dangerous. The scope is marked as changed, indicating impact can extend beyond the vulnerable component. Adobe has issued a security advisory (APSB26-68) addressing this issue. The vulnerability is currently undergoing analysis by NVD. Given the no-user-interaction requirement and arbitrary code execution potential, this represents a critical risk to ColdFusion deployments. Organizations running affected versions should apply patches immediately upon availability.