CVE-2026-48322 is an improper control of code generation vulnerability in Adobe ColdFusion 2025. It enables an attacker with low privileges to execute arbitrary code in the context of the current user. The vulnerability does not require user interaction and changes the security scope, potentially allowing full system compromise. The CVSS v3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially allowing attackers to fully compromise the affected system. The vulnerability affects confidentiality, integrity, and availability at a high level. Since the scope is changed, the impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Users should monitor Adobe's official security advisories for updates and apply patches once available.