CVE-2026-48273: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) in Adobe ColdFusion 2025

CVE-2026-48273 is an 'Eval Injection' vulnerability (CWE-95) in Adobe ColdFusion 2025 that permits arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this vulnerability remotely without user interaction. The vulnerability affects versions from 0 up to and including 12 and 0 up to and including 23 (as stated, though these version ranges appear inconsistent and likely reflect input data). The vulnerability has a CVSS v3.1 base score of 9.9, indicating critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to execute arbitrary code remotely without user interaction, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The changed scope suggests that the vulnerability affects components beyond the initially vulnerable code, increasing the potential impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, organizations should monitor Adobe's security advisories for updates. Until a fix is available, consider restricting access to ColdFusion services and applying compensating controls to limit exposure.