CVE-2026-48332 is a Server-Side Request Forgery (SSRF) vulnerability in Adobe ColdFusion 2025. This vulnerability enables a low-privileged attacker to bypass security controls and obtain unauthorized read access. Exploitation does not require user interaction, and the security scope is changed as a result. The CVSS 3.1 base score is 7.7, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high confidentiality impact. No vendor advisory or patch information is currently available.

An attacker with low privileges can exploit this SSRF vulnerability to bypass security features and gain unauthorized read access to resources. The vulnerability does not impact integrity or availability but compromises confidentiality. The scope change indicates that the vulnerability affects components beyond the initially vulnerable component, potentially increasing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor Adobe's security advisories for updates. No official mitigation or temporary fix has been provided at this time.