CVE-2026-48327 describes an Incorrect Authorization vulnerability in Adobe ColdFusion 2025. This flaw allows an attacker with low privileges and network access to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability changes the security scope, indicating a significant escalation or bypass of authorization controls. The CVSS v3.1 base score is 9.0, reflecting critical impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation can result in arbitrary code execution with high impact on system confidentiality, integrity, and availability. The attacker can execute code with the privileges of the current user, potentially leading to full system compromise depending on the user context. The vulnerability does not require user interaction, increasing the risk of automated or remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to ColdFusion 2025 instances and limit user privileges to reduce potential impact.