External risk intelligence

ColdFusion Eval Injection Vulnerability Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-48273

ColdFusion is a commercial application server platform widely deployed as an internet-facing web application engine or backend API gateway. Because it is designed to process external web requests, the vulnerable component is commonly exposed to the internet in standard production environments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in ColdFusion, a platform used for building and deploying web applications. This issue, classified as "Eval Injection," could allow a low-privileged attacker to execute arbitrary code, potentially impacting systems without requiring any user interaction. The primary concern is to determine if our environment utilizes this technology and confirm any exposure.

Code injection flaw in web application platform.
Threat to unauthorized code execution.
Confirm if ColdFusion is in use.

Attack Path

How an attacker could exploit the issue

A low-privileged attacker could reach this vulnerability by sending specially crafted requests to a ColdFusion application. This could allow them to execute arbitrary code within the application's environment, potentially leading to a compromise of the system. The vulnerability does not require any interaction from a user to be triggered.

Entry condition: Unauthenticated, low-privileged attacker.
Trigger point: Malicious request to vulnerable ColdFusion component.
Resulting risk: Arbitrary code execution, system compromise.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in ColdFusion could allow a low-privileged attacker to execute arbitrary code on the system without user interaction, provided the affected component is accessible over the network. This could impact the confidentiality, integrity, and availability of the system and any data it processes.

Arbitrary code execution.
Network-accessible ColdFusion.
System compromise and data impact.

Operational Fix

Recommended remediation, mitigation, and detection steps

Understanding who is responsible for addressing this critical vulnerability begins with identifying where ColdFusion is deployed. Given its role as an internet-facing application server, platform or infrastructure teams are likely accountable for managing the environment, while application owners must confirm business criticality and the presence of any custom code that might be affected. The immediate practical step is to inventory all ColdFusion instances, assess their exposure and business impact, and then coordinate remediation with the relevant teams and potentially Adobe.

Platform and application owners share responsibility.
Verify instance exposure and business criticality first.
Plan remediation based on risk and vendor guidance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ColdFusion and how is it used?

ColdFusion is a commercial application server platform. Organizations use it as a web application engine or backend API gateway to process dynamic web requests and serve content. It is designed to handle complex application logic, making it a common choice for hosting large-scale web services.

What does Eval Injection mean for CVE-2026-48273?

This vulnerability is classified as CWE-95, or Improper Neutralization of Directives in Dynamically Evaluated Code. In plain terms, the application incorrectly handles user-supplied data, allowing an attacker to inject and execute their own malicious commands. For this CVE, it means the server may treat untrusted input as valid program instructions, leading to unauthorized code execution.

How is this ColdFusion vulnerability triggered?

An attacker triggers the flaw by sending a specially crafted web request to the vulnerable component. Because the vulnerability involves how the application processes input, it does not require a user to click a link or perform any action. Please note that simply visiting a standard page without specific malicious data does not activate the bug.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies that because ColdFusion is typically used as an internet-facing application server, instances are frequently exposed to external network traffic. If your ColdFusion deployment is accessible over the internet to serve web requests, Halo classifies the potential for reachability as high.

What is the first step to address this threat?

Start by conducting an inventory to locate all ColdFusion instances within your network. Once identified, work with your infrastructure and application teams to verify the business criticality of those specific deployments. After mapping your environment, check the official Adobe security guidance provided in the reference links to plan your next moves, such as applying updates.

References

helpx.adobe.com/security/products/coldfusion/apsb26-119.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.