CVE-2026-48327 is an Incorrect Authorization vulnerability in Adobe ColdFusion 2025 that allows an attacker with low privileges to execute arbitrary code in the context of the current user. The vulnerability does not require user interaction and results in a changed security scope, indicating a potential privilege escalation or bypass of authorization controls. The CVSS v3.1 vector indicates the attack requires adjacent network access, low attack complexity, low privileges, no user interaction, and impacts confidentiality, integrity, and availability with high severity. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker with adjacent network access and low privileges to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability at a high level. Because the scope is changed, the attacker may gain elevated privileges or bypass authorization mechanisms.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the ColdFusion 2025 service to trusted networks and users only, and monitor for suspicious activity related to authorization bypass attempts.