{"schema_version":1,"title":"Adobe ColdFusion vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 70 vulnerabilities in Adobe ColdFusion: 0 in the last 7 days and 37 in the last 90 days, 36 of them critical and 17 exploited in the wild. The most recent, CVE-2026-76190, was published on 8 September 2026.","url":"https://junglewise.ai/threats/technologies/coldfusion","json_url":"https://junglewise.ai/threats/technologies/coldfusion.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/coldfusion","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":24,"all_time":70,"critical":36,"exploited":17,"last_7_days":0,"last_30_days":8,"last_90_days":37,"last_365_days":54},"latest":[{"cve":"CVE-2026-76190","cvss":8.6,"epss":0.0083,"slug":"cve-2026-76190-adobe-coldfusion-code-injection-in-dynamically-evaluated-code","title":"Adobe ColdFusion code injection in dynamically evaluated code","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:24.157+00:00","url":"https://junglewise.ai/threats/cve-2026-76190-adobe-coldfusion-code-injection-in-dynamically-evaluated-code"},{"cve":"CVE-2026-76000","cvss":6.5,"epss":0.0041,"slug":"cve-2026-76000-adobe-coldfusion-uncontrolled-resource-consumption-in-parser","title":"Adobe ColdFusion uncontrolled resource consumption in parser","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:23.893+00:00","url":"https://junglewise.ai/threats/cve-2026-76000-adobe-coldfusion-uncontrolled-resource-consumption-in-parser"},{"cve":"CVE-2026-75999","cvss":8.4,"epss":0.0047,"slug":"cve-2026-75999-adobe-coldfusion-improper-input-validation-remote-code-execution","title":"Adobe ColdFusion improper input validation remote code execution","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:23.76+00:00","url":"https://junglewise.ai/threats/cve-2026-75999-adobe-coldfusion-improper-input-validation-remote-code-execution"},{"cve":"CVE-2026-75998","cvss":7.5,"epss":0.0082,"slug":"cve-2026-75998-adobe-coldfusion-improper-access-control-arbitrary-file-read","title":"Adobe ColdFusion improper access control arbitrary file read","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:23.637+00:00","url":"https://junglewise.ai/threats/cve-2026-75998-adobe-coldfusion-improper-access-control-arbitrary-file-read"},{"cve":"CVE-2026-75993","cvss":8.5,"epss":0.0045,"slug":"cve-2026-75993-adobe-coldfusion-reflected-cross-site-scripting","title":"Adobe ColdFusion reflected cross-site scripting","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:23.493+00:00","url":"https://junglewise.ai/threats/cve-2026-75993-adobe-coldfusion-reflected-cross-site-scripting"},{"cve":"CVE-2026-75746","cvss":9.1,"epss":0.0099,"slug":"cve-2026-75746-adobe-coldfusion-sql-injection-with-arbitrary-code-execution","title":"Adobe ColdFusion SQL injection with arbitrary code execution","severity":"critical","exploited":false,"published_at":"2026-09-08T20:18:22.12+00:00","url":"https://junglewise.ai/threats/cve-2026-75746-adobe-coldfusion-sql-injection-with-arbitrary-code-execution"},{"cve":"CVE-2026-48273","cvss":9.9,"epss":0.0127,"slug":"cve-2026-48273-adobe-coldfusion-eval-injection-in-dynamically-evaluated-code","title":"Adobe ColdFusion eval injection in dynamically evaluated code","severity":"critical","exploited":false,"published_at":"2026-09-08T20:17:33.56+00:00","url":"https://junglewise.ai/threats/cve-2026-48273-adobe-coldfusion-eval-injection-in-dynamically-evaluated-code"},{"cve":"CVE-2026-83961","cvss":7.1,"epss":0.0042,"slug":"cve-2026-83961-adobe-coldfusion-improper-authentication-privilege-escalation","title":"Adobe ColdFusion improper authentication privilege escalation","severity":"high","exploited":false,"published_at":"2026-09-03T16:18:23.383+00:00","url":"https://junglewise.ai/threats/cve-2026-83961-adobe-coldfusion-improper-authentication-privilege-escalation"},{"cve":"CVE-2026-21279","cvss":8.2,"epss":0.0079,"slug":"cve-2026-21279-adobe-coldfusion-improper-input-validation-security-feature","title":"Adobe ColdFusion improper input validation security feature bypass","severity":"high","exploited":false,"published_at":"2026-08-11T17:17:55.283+00:00","url":"https://junglewise.ai/threats/cve-2026-21279-adobe-coldfusion-improper-input-validation-security-feature"},{"cve":"CVE-2026-21273","cvss":8.7,"epss":0.0086,"slug":"cve-2026-21273-adobe-coldfusion-improper-input-validation-privilege-escalation","title":"Adobe ColdFusion improper input validation privilege escalation","severity":"high","exploited":false,"published_at":"2026-08-11T17:17:55.16+00:00","url":"https://junglewise.ai/threats/cve-2026-21273-adobe-coldfusion-improper-input-validation-privilege-escalation"},{"cve":"CVE-2026-21269","cvss":4.6,"epss":0.005,"slug":"cve-2026-21269-adobe-coldfusion-stored-xss-in-form-fields","title":"Adobe ColdFusion stored XSS in form fields","severity":"medium","exploited":false,"published_at":"2026-08-11T17:17:55.02+00:00","url":"https://junglewise.ai/threats/cve-2026-21269-adobe-coldfusion-stored-xss-in-form-fields"},{"cve":"CVE-2026-48338","cvss":6.8,"slug":"cve-2026-48338-adobe-coldfusion-path-traversal-arbitrary-file-read","title":"Adobe ColdFusion path traversal arbitrary file read","severity":"medium","exploited":false,"published_at":"2026-07-14T21:16:59.69+00:00","url":"https://junglewise.ai/threats/cve-2026-48338-adobe-coldfusion-path-traversal-arbitrary-file-read"},{"cve":"CVE-2026-48332","cvss":7.7,"slug":"cve-2026-48332-adobe-coldfusion-ssrf-in-security-feature-bypass","title":"Adobe ColdFusion SSRF in security feature bypass","severity":"high","exploited":false,"published_at":"2026-07-14T21:16:59.583+00:00","url":"https://junglewise.ai/threats/cve-2026-48332-adobe-coldfusion-ssrf-in-security-feature-bypass"},{"cve":"CVE-2026-48329","cvss":2.7,"slug":"cve-2026-48329-adobe-coldfusion-insufficient-session-expiration","title":"Adobe ColdFusion insufficient session expiration","severity":"low","exploited":false,"published_at":"2026-07-14T21:16:59.47+00:00","url":"https://junglewise.ai/threats/cve-2026-48329-adobe-coldfusion-insufficient-session-expiration"},{"cve":"CVE-2026-48328","cvss":7.7,"slug":"cve-2026-48328-adobe-coldfusion-security-feature-bypass-via-improper-input","title":"Adobe ColdFusion security feature bypass via improper input validation","severity":"high","exploited":false,"published_at":"2026-07-14T21:16:59.363+00:00","url":"https://junglewise.ai/threats/cve-2026-48328-adobe-coldfusion-security-feature-bypass-via-improper-input"},{"cve":"CVE-2026-48327","cvss":9,"slug":"cve-2026-48327-adobe-coldfusion-incorrect-authorization-in-code-execution","title":"Adobe ColdFusion incorrect authorization in code execution","severity":"critical","exploited":false,"published_at":"2026-07-14T21:16:59.257+00:00","url":"https://junglewise.ai/threats/cve-2026-48327-adobe-coldfusion-incorrect-authorization-in-code-execution"},{"cve":"CVE-2026-48325","cvss":9.3,"slug":"cve-2026-48325-adobe-coldfusion-missing-authentication-for-critical-function","title":"Adobe ColdFusion missing authentication for critical function","severity":"critical","exploited":false,"published_at":"2026-07-14T21:16:59.143+00:00","url":"https://junglewise.ai/threats/cve-2026-48325-adobe-coldfusion-missing-authentication-for-critical-function"},{"cve":"CVE-2026-48324","cvss":9.1,"slug":"cve-2026-48324-adobe-coldfusion-sql-injection-leading-to-arbitrary-code","title":"Adobe ColdFusion SQL injection leading to arbitrary code execution","severity":"critical","exploited":false,"published_at":"2026-07-14T21:16:59.023+00:00","url":"https://junglewise.ai/threats/cve-2026-48324-adobe-coldfusion-sql-injection-leading-to-arbitrary-code"},{"cve":"CVE-2026-48322","cvss":9.6,"slug":"cve-2026-48322-adobe-coldfusion-code-injection-in-coldfusion-2023-and-2025","title":"Adobe ColdFusion code injection in ColdFusion 2023 and 2025","severity":"critical","exploited":false,"published_at":"2026-07-14T21:16:58.92+00:00","url":"https://junglewise.ai/threats/cve-2026-48322-adobe-coldfusion-code-injection-in-coldfusion-2023-and-2025"},{"cve":"CVE-2026-48321","cvss":9.3,"slug":"cve-2026-48321-adobe-coldfusion-privilege-escalation-via-incorrect-authorization","title":"Adobe ColdFusion privilege escalation via incorrect authorization","severity":"critical","exploited":false,"published_at":"2026-07-14T21:16:58.813+00:00","url":"https://junglewise.ai/threats/cve-2026-48321-adobe-coldfusion-privilege-escalation-via-incorrect-authorization"},{"cve":"CVE-2026-48320","cvss":8.5,"slug":"cve-2026-48320-adobe-coldfusion-reflected-xss","title":"Adobe ColdFusion reflected XSS","severity":"high","exploited":false,"published_at":"2026-07-14T21:16:58.703+00:00","url":"https://junglewise.ai/threats/cve-2026-48320-adobe-coldfusion-reflected-xss"},{"cve":"CVE-2026-48319","cvss":9.1,"slug":"cve-2026-48319-adobe-coldfusion-path-traversal-in-directory-handling","title":"Adobe ColdFusion path traversal in directory handling","severity":"critical","exploited":false,"published_at":"2026-07-14T21:16:58.6+00:00","url":"https://junglewise.ai/threats/cve-2026-48319-adobe-coldfusion-path-traversal-in-directory-handling"},{"cve":"CVE-2026-48318","cvss":9.9,"slug":"cve-2026-48318-adobe-coldfusion-path-traversal-arbitrary-file-read","title":"Adobe ColdFusion path traversal arbitrary file read","severity":"critical","exploited":false,"published_at":"2026-07-14T21:16:58.493+00:00","url":"https://junglewise.ai/threats/cve-2026-48318-adobe-coldfusion-path-traversal-arbitrary-file-read"},{"cve":"CVE-2026-48284","cvss":9.6,"slug":"cve-2026-48284-adobe-coldfusion-arbitrary-code-execution-via-improper-input","title":"Adobe ColdFusion arbitrary code execution via improper input validation","severity":"critical","exploited":false,"published_at":"2026-07-14T21:16:58.043+00:00","url":"https://junglewise.ai/threats/cve-2026-48284-adobe-coldfusion-arbitrary-code-execution-via-improper-input"},{"cve":"CVE-2026-48364","cvss":8.2,"slug":"cve-2026-48364-adobe-coldfusion-uncontrolled-search-path-element-vulnerability","title":"Adobe ColdFusion uncontrolled search path element vulnerability","severity":"high","exploited":false,"published_at":"2026-07-13T21:16:48.337+00:00","url":"https://junglewise.ai/threats/cve-2026-48364-adobe-coldfusion-uncontrolled-search-path-element-vulnerability"}],"weekly":[{"week":"2026-06-29","critical":7,"exploited":1,"vulnerabilities":10},{"week":"2026-07-06","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":8,"exploited":0,"vulnerabilities":15},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-07","critical":2,"exploited":0,"vulnerabilities":7},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Adobe Acrobat","slug":"acrobat","vulnerabilities":63,"url":"https://junglewise.ai/threats/technologies/acrobat"},{"name":"Adobe Commerce","slug":"commerce","vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/commerce"},{"name":"Adobe Acrobat Reader","slug":"acrobat-reader","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/acrobat-reader"},{"name":"Adobe Flash Player","slug":"flash-player","vulnerabilities":56,"url":"https://junglewise.ai/threats/technologies/flash-player"},{"name":"Adobe AIR","slug":"air","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/air"},{"name":"Adobe Acrobat DC","slug":"acrobat-dc","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/acrobat-dc"},{"name":"Adobe Acrobat Reader DC","slug":"acrobat-reader-dc","vulnerabilities":37,"url":"https://junglewise.ai/threats/technologies/acrobat-reader-dc"},{"name":"Adobe Reader","slug":"reader","vulnerabilities":32,"url":"https://junglewise.ai/threats/technologies/reader"},{"name":"Adobe Magento Open Source","slug":"magento-open-source","vulnerabilities":24,"url":"https://junglewise.ai/threats/technologies/magento-open-source"},{"name":"Adobe Bridge","slug":"bridge","vulnerabilities":23,"url":"https://junglewise.ai/threats/technologies/bridge"},{"name":"Adobe Illustrator","slug":"illustrator","vulnerabilities":23,"url":"https://junglewise.ai/threats/technologies/illustrator"},{"name":"Adobe Substance 3D Designer","slug":"substance-3d-designer","vulnerabilities":23,"url":"https://junglewise.ai/threats/technologies/substance-3d-designer"}],"technology":{"hub":true,"name":"Adobe ColdFusion","slug":"coldfusion","vendor":{"name":"Adobe","slug":"adobe","url":"https://junglewise.ai/threats/vendors/adobe"},"aliases":[],"category":"web-server","homepage":"https://www.adobe.com/products/coldfusion-family.html","description":"A commercial web application development platform that uses the CFML scripting language.","url":"https://junglewise.ai/threats/technologies/coldfusion"},"most_severe":[{"cve":"CVE-2026-48282","cvss":10,"epss":0.0102,"slug":"cve-2026-48282-adobe-coldfusion-path-traversal-in-multiple-versions","title":"Adobe ColdFusion path traversal in multiple versions","severity":"critical","exploited":true,"published_at":"2026-06-30T16:16:54.533+00:00","url":"https://junglewise.ai/threats/cve-2026-48282-adobe-coldfusion-path-traversal-in-multiple-versions"},{"cve":"CVE-2017-3066","cvss":9.8,"slug":"cve-2017-3066-adobe-coldfusion-deserialization-vulnerability","title":"Adobe ColdFusion Deserialization Vulnerability","severity":"critical","exploited":true,"published_at":"2025-02-24T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2017-3066-adobe-coldfusion-deserialization-vulnerability"},{"cve":"CVE-2023-29300","cvss":9.8,"slug":"cve-2023-29300-adobe-coldfusion-deserialization-of-untrusted-data-vulnerability","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","severity":"critical","exploited":true,"published_at":"2024-01-08T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-29300-adobe-coldfusion-deserialization-of-untrusted-data-vulnerability"},{"cve":"CVE-2023-38203","cvss":9.8,"slug":"cve-2023-38203-adobe-coldfusion-deserialization-of-untrusted-data-vulnerability","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","severity":"critical","exploited":true,"published_at":"2024-01-08T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-38203-adobe-coldfusion-deserialization-of-untrusted-data-vulnerability"},{"cve":"CVE-2023-26359","cvss":9.8,"slug":"cve-2023-26359-adobe-coldfusion-deserialization-of-untrusted-data-vulnerability","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","severity":"critical","exploited":true,"published_at":"2023-08-21T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-26359-adobe-coldfusion-deserialization-of-untrusted-data-vulnerability"},{"cve":"CVE-2023-26360","cvss":9.8,"slug":"cve-2023-26360-adobe-coldfusion-deserialization-of-untrusted-data-vulnerability","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","severity":"critical","exploited":true,"published_at":"2023-03-15T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-26360-adobe-coldfusion-deserialization-of-untrusted-data-vulnerability"},{"cve":"CVE-2010-2861","cvss":9.8,"slug":"cve-2010-2861-adobe-coldfusion-directory-traversal-vulnerability","title":"Adobe ColdFusion Directory Traversal Vulnerability","severity":"critical","exploited":true,"published_at":"2022-03-25T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2010-2861-adobe-coldfusion-directory-traversal-vulnerability"},{"cve":"CVE-2013-0625","cvss":9.8,"slug":"cve-2013-0625-adobe-coldfusion-authentication-bypass-vulnerability","title":"Adobe ColdFusion Authentication Bypass Vulnerability","severity":"critical","exploited":true,"published_at":"2022-03-07T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2013-0625-adobe-coldfusion-authentication-bypass-vulnerability"},{"cve":"CVE-2013-0632","cvss":9.8,"slug":"cve-2013-0632-adobe-coldfusion-authentication-bypass-vulnerability","title":"Adobe ColdFusion Authentication Bypass Vulnerability","severity":"critical","exploited":true,"published_at":"2022-03-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2013-0632-adobe-coldfusion-authentication-bypass-vulnerability"},{"cve":"CVE-2018-4939","cvss":9.8,"slug":"cve-2018-4939-adobe-coldfusion-deserialization-of-untrusted-data-vulnerability","title":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2018-4939-adobe-coldfusion-deserialization-of-untrusted-data-vulnerability"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}