Search: CVE-2026-48273

Adobe ColdFusion 2025 is affected by a critical vulnerability (CVE-2026-48273) involving improper neutralization of directives in dynamically evaluated code, also known as 'Eval Injection'. This flaw allows a low-privileged attacker to execute arbitrary code without requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability, with a high CVSS score of 9.9. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component. No patch information is provided in the input data.