CVE-2026-48282 is a path traversal vulnerability in Adobe ColdFusion that improperly limits pathnames to restricted directories. This weakness enables an unauthenticated attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects ColdFusion versions 2025.9, 2023.20, and earlier. The CVSS v3.1 base score is 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. No vendor advisory or patch information is currently available, and the remediation level is unspecified.

Successful exploitation can lead to arbitrary code execution with the privileges of the ColdFusion process user, potentially resulting in full system compromise. The vulnerability requires no user interaction and can be exploited remotely over the network. The scope is changed, meaning the vulnerability affects resources beyond the initially intended security boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor Adobe's security advisories closely. Avoid exposing vulnerable ColdFusion instances to untrusted networks if possible.