CVE-2026-48325 is a Missing Authentication for Critical Function vulnerability (CWE-306) in Adobe ColdFusion 2025. It enables remote attackers to execute arbitrary code in the context of the current user without any user interaction. The vulnerability changes the security scope, indicating a potential escalation or broader impact within the application environment. The CVSS v3.1 base score is 9.3, reflecting critical severity with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation could lead to arbitrary code execution with the privileges of the current user, compromising confidentiality and integrity of the affected system. There is no indication of availability impact. The vulnerability does not require user interaction and can be exploited remotely over an adjacent network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor Adobe's security advisories for updates and apply patches promptly once available.