CVE-2026-48321 describes an Incorrect Authorization vulnerability in Adobe ColdFusion 2025. This flaw enables an attacker to escalate privileges by bypassing authorization controls, resulting in unauthorized read and write access. The vulnerability does not require user interaction and changes the security scope, indicating a significant impact on the confidentiality and integrity of the system. The CVSS v3.1 base score is 9.3 (critical), with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and scope changed. No vendor advisory or patch information is currently available.

Successful exploitation can lead to privilege escalation, allowing an attacker to read and modify data without authorization. The confidentiality and integrity of the affected system are severely impacted. Availability is not affected. The vulnerability can be exploited remotely from an adjacent network without any user interaction or prior privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected ColdFusion instance from untrusted sources and monitor for unusual activity related to authorization bypass attempts.