A vulnerability disclosed in Adobe ColdFusion on 11 August 2026 carries the highest severity rating the scoring system can hand out, a CVSS base score of 10.0 out of 10. Scores that high are rare, and on this particular product they are worth reading twice: ColdFusion has been one of the more reliably attacked pieces of enterprise software this year.
The flaw is tracked as CVE-2026-48362. It is an OS command injection issue, which means text that should have been handled as ordinary data instead reaches the underlying operating system as instructions to run. According to the entry in the National Vulnerability Database, exploiting it results in arbitrary code execution in the context of the current user, and it does not require any user interaction.
What a perfect 10 actually buys an attacker
Two properties push the score to its ceiling. The first is that no user interaction is needed, so there is nobody to fool and nothing to click. The second is that the CVSS scope is marked as changed, which is the standard's way of saying the damage does not stay inside the component that had the bug: a successful attack can reach resources beyond it. When every impact dimension is pinned at its worst and neither privileges nor user help are required, the arithmetic lands on 10.0.
Past that, the public record is thin. The database entry does not list affected ColdFusion versions, does not publish exploitation detail, and does not describe the path an attacker would take to reach the vulnerable code. Adobe documents affected builds and their fixes in its own ColdFusion security bulletins, and administrators should treat Adobe's bulletin, rather than any summary of it, as the authority on which version to install.
Why this product keeps coming back
ColdFusion has had a busy summer. In July we reported that CISA added a ColdFusion path traversal flaw to its Known Exploited Vulnerabilities catalog after attackers were observed using it, only days after Adobe patched a batch of critical code execution bugs in the same product. Before that, in June, we covered an intrusion in which attackers turned a ColdFusion foothold into a web shell, switched off Windows Defender and dumped credentials. Internet-facing ColdFusion servers are a well-established destination for opportunistic scanning, and on this product a maximum-severity command injection has historically drawn attention quickly.
High score, low probability, for now
One number cuts against the alarm. The Exploit Prediction Scoring System, which estimates the probability of exploitation activity in the next 30 days, currently puts CVE-2026-48362 at roughly 2%, which still places it in about the 80th percentile of all scored vulnerabilities. The flaw is not in CISA's Known Exploited Vulnerabilities catalog and no public exploitation has been recorded. Absence from that catalog is not evidence that nothing is happening, but it does mean no attack has been documented so far.
Patch on Adobe's numbers, then close the door
Apply the fix Adobe specifies as soon as your change process allows, and verify the running build afterwards instead of assuming the update took. The more durable control is exposure. ColdFusion administrative interfaces and management endpoints have no business being reachable from the open internet, and restricting them to a VPN or an allowlisted management network removes most of the untargeted traffic that turns a published advisory into an incident.
A CVSS 10.0 on a product with ColdFusion's record is not a routine line in a patch queue. The exploitation probability is low today, and on this platform that has repeatedly turned out to be a temporary condition.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.