CVE-2026-48376

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48376", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-05-21T15:28:38.142Z", "datePublished": "2026-08-11T16:31:01.690Z", "dateUpdated": "2026-08-27T22:33:57.284Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ColdFusion 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2025.0.11", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2025.0.12", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ColdFusion 2023", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2023.0.22", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2023.0.23", "versionType": "custom"}]}], "datePublic": "2026-08-11T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 5.4, "environmentalSeverity": "MEDIUM", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "NETWORK", "modifiedAvailabilityImpact": "LOW", "modifiedConfidentialityImpact": "NONE", "modifiedIntegrityImpact": "LOW", "modifiedPrivilegesRequired": "LOW", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "NONE", "privilegesRequired": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 5.4, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "description": "Improper Encoding or Escaping of Output (CWE-116)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:33:57.284Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html"}], "source": {"discovery": "EXTERNAL"}, "title": "ColdFusion | Improper Encoding or Escaping of Output (CWE-116)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T18:35:10.593182Z", "id": "CVE-2026-48376", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T18:35:52.470Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48376", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T18:35:10.593182Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T18:35:18.998Z"}}], "cna": {"title": "ColdFusion | Improper Encoding or Escaping of Output (CWE-116)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "modifiedScope": "UNCHANGED", "temporalScore": 5.4, "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "MEDIUM", "availabilityImpact": "LOW", "environmentalScore": 5.4, "privilegesRequired": "LOW", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "NONE", "environmentalSeverity": "MEDIUM", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "LOW", "modifiedUserInteraction": "NONE", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "LOW", "modifiedPrivilegesRequired": "LOW", "modifiedConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "ColdFusion 2025", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025.0.11"}, {"status": "unaffected", "version": "2025.0.12", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "ColdFusion 2023", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2023.0.22"}, {"status": "unaffected", "version": "2023.0.23", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-11T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "Improper Encoding or Escaping of Output (CWE-116)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:33:57.284Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48376", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:33:57.284Z", "dateReserved": "2026-05-21T15:28:38.142Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-08-11T16:31:01.690Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ColdFusion 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2025.0.11", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2025.0.12", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ColdFusion 2023", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2023.0.22", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2023.0.23", "versionType": "custom"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*", "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*", "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update10:*:*:*:*:*:*", "matchCriteriaId": "645D1B5F-2DAB-4AB8-A465-AC37FF494F95", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update11:*:*:*:*:*:*", "matchCriteriaId": "ED6D8996-0770-4C9F-BEA5-87EA479D40A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update12:*:*:*:*:*:*", "matchCriteriaId": "4836086E-3D4A-4A07-A372-382D385CB490", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update13:*:*:*:*:*:*", "matchCriteriaId": "CBC19168-4184-4B59-B9C8-E98844124EED", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update14:*:*:*:*:*:*", "matchCriteriaId": "A60DCD92-9A5B-411C-9554-642C91D77FAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update15:*:*:*:*:*:*", "matchCriteriaId": "58CC65EF-60A3-4DFA-AA51-E5013F116CEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update16:*:*:*:*:*:*", "matchCriteriaId": "2E3EBFB1-4488-4924-A2E2-B7E422D68345", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update17:*:*:*:*:*:*", "matchCriteriaId": "A683F9B2-A0DC-4AA0-BE97-9E74FA200AB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update18:*:*:*:*:*:*", "matchCriteriaId": "8689F35F-9A81-45D2-B782-DBA12306BA45", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update19:*:*:*:*:*:*", "matchCriteriaId": "5FAA5985-4B25-46C5-8064-0713AB251704", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update2:*:*:*:*:*:*", "matchCriteriaId": "EB88D4FE-5496-4639-BAF2-9F29F24ABF29", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update20:*:*:*:*:*:*", "matchCriteriaId": "9E3884AF-7A1A-4604-B653-6694B7BD1E86", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update21:*:*:*:*:*:*", "matchCriteriaId": "914DDD70-EF8D-4D0F-B4E2-ABCA14337EB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update22:*:*:*:*:*:*", "matchCriteriaId": "F277616E-64A7-4801-BBB6-D01AF5761951", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update3:*:*:*:*:*:*", "matchCriteriaId": "43E0ED98-2C1F-40B8-AF60-FEB1D85619C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update4:*:*:*:*:*:*", "matchCriteriaId": "76204873-C6E0-4202-8A03-0773270F1802", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update5:*:*:*:*:*:*", "matchCriteriaId": "C1A22BE9-0D47-4BA8-8BDB-9B12D7A0F7C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update6:*:*:*:*:*:*", "matchCriteriaId": "E3A83642-BF14-4C37-BD94-FA76AABE8ADC", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update7:*:*:*:*:*:*", "matchCriteriaId": "A892E1DC-F2C8-4F53-8580-A2D1BEED5A25", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update8:*:*:*:*:*:*", "matchCriteriaId": "DB97ADBA-C1A9-4EE0-9509-68CB12358AE5", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2023:update9:*:*:*:*:*:*", "matchCriteriaId": "E17C38F0-9B0F-4433-9CBD-6E3D63EA9BDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:-:*:*:*:*:*:*", "matchCriteriaId": "30779417-D4E5-4A01-BE0E-1CE1D134292A", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update1:*:*:*:*:*:*", "matchCriteriaId": "80D7FC6A-F264-4CB1-A18D-B091EBA47882", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update10:*:*:*:*:*:*", "matchCriteriaId": "C39E4812-C14C-4E3F-BD27-947F51C18308", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update11:*:*:*:*:*:*", "matchCriteriaId": "0C946E44-D23D-409B-B770-AAB269A4136C", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update2:*:*:*:*:*:*", "matchCriteriaId": "E3DA0D20-93BA-4C76-A400-159853CD7277", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*", "matchCriteriaId": "5BAB6F21-61F1-43AB-88BA-553CD9AD6C0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update4:*:*:*:*:*:*", "matchCriteriaId": "C85288B9-5D63-49EA-828A-8DB3BB2367F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update5:*:*:*:*:*:*", "matchCriteriaId": "3882A011-5A01-48E7-B5E7-5A837B1CE245", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update6:*:*:*:*:*:*", "matchCriteriaId": "AACCE621-3380-4144-BA1B-AA26FE96B902", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update7:*:*:*:*:*:*", "matchCriteriaId": "EBC62370-3FA2-4AF7-A201-4155D09051F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update8:*:*:*:*:*:*", "matchCriteriaId": "D7616F34-9422-4815-806F-4484F68ED2A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:coldfusion:2025:update9:*:*:*:*:*:*", "matchCriteriaId": "FB078BC9-164F-46D0-99F8-086F93FF2046", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction."}], "id": "CVE-2026-48376", "lastModified": "2026-08-28T00:17:56.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48376", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T18:35:10.593182Z", "version": "2.0.3"}}]}, "published": "2026-08-11T17:17:59.877", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2023.0.22]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2023.0.23"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ColdFusion 2023", "source": "cna", "vendor": "Adobe"}, "product": "coldfusion_2023", "vendor": "adobe"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2025.0.11]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2025.0.12"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ColdFusion 2025", "source": "cna", "vendor": "Adobe"}, "product": "coldfusion_2025", "vendor": "adobe"}], "created": "2026-08-12T21:15:09.660703+00:00", "updated": "2026-09-24T22:00:21.990442+00:00", "vendors": ["adobe", "adobe$PRODUCT$coldfusion_2023", "adobe$PRODUCT$coldfusion_2025"]}