CVE-2026-48363 is an Uncontrolled Search Path Element vulnerability in Adobe ColdFusion that affects versions 2025.9, 2023.20, and earlier. This flaw allows an attacker to execute arbitrary code with the privileges of the current user by tricking the user into opening a malicious file. The vulnerability requires user interaction and changes the security scope. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. The attack requires user interaction, limiting the attack vector to scenarios where a user opens a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources to prevent exploitation.