CVE-2026-48362: ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48362?
The severity of CVE-2026-48362 is critical, rated at 10 on the CVSS scale.
What impact does CVE-2026-48362 have on ColdFusion?
CVE-2026-48362 allows an attacker to perform OS Command Injection, potentially leading to arbitrary code execution.
Who is affected by CVE-2026-48362?
CVE-2026-48362 affects users of Adobe ColdFusion that do not mitigate against the OS Command Injection vulnerability.
How can I fix CVE-2026-48362?
To fix CVE-2026-48362, users should update to the latest version of Adobe ColdFusion that addresses this vulnerability.
What type of attack vector is associated with CVE-2026-48362?
CVE-2026-48362 can be exploited through a network vector, allowing remote attackers to execute commands on the server.