CVE-2026-48282 is a critical path traversal vulnerability in Adobe ColdFusion affecting versions >=2023.20 and <2025.10. The vulnerability allows an attacker to improperly limit a pathname to a restricted directory, enabling arbitrary code execution in the context of the current user. The attack vector is network-based, requires no privileges or user interaction, and impacts confidentiality, integrity, and availability with a changed scope. No official remediation or patch has been documented yet, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to full compromise of the affected ColdFusion server, including arbitrary code execution with the privileges of the ColdFusion process. This impacts confidentiality, integrity, and availability of the system. The vulnerability does not require user interaction and can be exploited remotely, increasing the risk of widespread impact if left unmitigated.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the ColdFusion server to trusted users only and monitor for suspicious activity related to path traversal attempts. Avoid exposing ColdFusion services directly to untrusted networks.