CVE-2026-47932 is a path traversal vulnerability in Adobe ColdFusion affecting versions 2023.0.0 to 2023.19 and 2025.0.0 to 2025.8. This vulnerability arises from improper limitation of a pathname to a restricted directory, enabling an attacker to execute arbitrary code in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially compromising system confidentiality, integrity, and availability. The attack requires user interaction, limiting remote exploitation without user involvement. The scope of impact is changed, indicating that the vulnerability affects resources beyond the initially intended boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Adobe's advisories for updates. Until a patch is available, users should exercise caution with files received from untrusted sources to prevent exploitation via malicious files.