CVE-2026-48364 is an Uncontrolled Search Path Element vulnerability in Adobe ColdFusion affecting versions 2023.0 to 2023.20 and 2025.0 to 2025.9. This weakness allows an attacker to influence the search path used by the application, potentially causing execution of arbitrary code with the privileges of the current user. Exploitation requires that the victim opens a malicious file, indicating user interaction is necessary. The vulnerability has a CVSS 3.1 base score of 8.2, reflecting high severity with local attack vector, low attack complexity, low privileges required, and user interaction. The scope is changed, and the impact includes high confidentiality, integrity, and availability impacts.

Successful exploitation can lead to arbitrary code execution under the context of the current user, compromising confidentiality, integrity, and availability of the affected system. Because user interaction is required, the attack vector is local and limited to scenarios where a user opens a malicious file. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, users should exercise caution with files received from untrusted sources to prevent exploitation requiring user interaction.