CVE-2026-48273

Adobe Issues Critical Security Updates for ColdFusion Fixing Nine CVEs Including Eval Injection Flaws

Adobe has released security updates for Adobe ColdFusion to address nine vulnerabilities, urging users to apply the patches immediately. The update coincides with Patch Tuesday on September 8, 2026, and covers issues such as Eval injection, SQL injection, cross-site scripting, and access control weaknesses. Six of the vulnerabilities are rated Critical, with the highest CVSS v3.1 base score reaching 9.9 for CVE-2026-48273. The remaining three vulnerabilities are classified as Important. Adobe ColdFusion users are advised to update without delay to mitigate risks of code injection and unauthorized access. The advisory also references related security issues in other products including Canva, BIG-IP, and Dell SCG.

Adobe Issues Critical Security Updates for ColdFusion with Multiple High-Severity Vulnerabilities

Adobe has released security updates for Adobe ColdFusion to address 15 vulnerabilities disclosed in a security advisory on August 11, 2026. Among them, CVE-2026-48362 is an OS command injection flaw that allows arbitrary code execution and carries the maximum CVSSv3.1 base score of 10.0. Two additional issues, CVE-2026-48273 involving dynamic code evaluation and CVE-2026-71384 related to authorization bypass leading to denial of service, received scores of 9.9 and 9.6 respectively. Eight further vulnerabilities were rated Critical, prompting Adobe to urge immediate patching. The advisory highlights risks across multiple attack vectors and emphasizes rapid remediation to prevent potential exploitation.