CVE-2026-48319 is a path traversal vulnerability in Adobe ColdFusion 2025 that improperly limits pathname access to restricted directories. This flaw enables an attacker with high privileges to execute arbitrary code in the context of the current user. The vulnerability does not require user interaction and changes the security scope, indicating a significant escalation of impact. The CVSS v3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by Adobe as of the published date.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially resulting in full system compromise including confidentiality, integrity, and availability impacts. The vulnerability does not require user interaction and affects the security scope, increasing the severity of the threat.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to ColdFusion 2025 instances to trusted users only and monitor for suspicious activity consistent with path traversal exploitation attempts.