CVE-2026-48363 is an Uncontrolled Search Path Element vulnerability in Adobe ColdFusion that affects versions 2023.0 through 2023.20 and versions earlier than 2025.9. The issue could lead to arbitrary code execution with the privileges of the current user. Successful exploitation requires user interaction, specifically opening a malicious file. The vulnerability changes the security scope and has a CVSS 3.1 base score of 8.2, indicating high impact on confidentiality, integrity, and availability.

If exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the current user, potentially leading to full compromise of the affected system. The requirement for user interaction limits the attack vector to scenarios where a user opens a malicious file. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, users should exercise caution with files from untrusted sources and limit user privileges where possible.