CVE-2026-48321— ColdFusion 权限验证错误漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-48321の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
ColdFusion | Incorrect Authorization (CWE-863)
ソース: NVD (National Vulnerability Database)
脆弱性説明
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
授权机制不正确
ソース: NVD (National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Adobe | ColdFusion 2025 | 0 ~ 10 | - | |
| Adobe | ColdFusion 2023 | 0 ~ 21 | - |
II. CVE-2026-48321の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-48321のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-48321 厂商安全公告 (1)
Same Patch Batch · Adobe · 2026-07-14 · 88 CVEs total
| CVE-2026-48318 | 9.9 CRITICAL | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' |
| CVE-2026-48284 | 9.6 CRITICAL | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-48322 | 9.6 CRITICAL | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) |
| CVE-2026-48356 | 9.6 CRITICAL | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) |
| CVE-2026-48259 | 9.6 CRITICAL | Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918) |
| CVE-2026-48359 | 9.6 CRITICAL | Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') ( |
| CVE-2026-48334 | 9.3 CRITICAL | Illustrator | Improper Input Validation (CWE-20) |
| CVE-2026-48325 | 9.3 CRITICAL | ColdFusion | Missing Authentication for Critical Function (CWE-306) |
| CVE-2026-48324 | 9.1 CRITICAL | ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje |
| CVE-2026-48358 | 9.1 CRITICAL | Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) |
| CVE-2026-48319 | 9.1 CRITICAL | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' |
| CVE-2026-48327 | 9.0 CRITICAL | ColdFusion | Incorrect Authorization (CWE-863) |
| CVE-2026-47994 | 8.7 HIGH | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) |
| CVE-2026-48350 | 8.6 HIGH | Animate | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') ( |
| CVE-2026-48310 | 8.6 HIGH | Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('P |
| CVE-2026-48275 | 8.6 HIGH | Illustrator | Untrusted Search Path (CWE-426) |
| CVE-2026-48252 | 8.6 HIGH | Adobe Experience Manager | Missing Authentication for Critical Function (CWE-306) |
| CVE-2026-47988 | 8.6 HIGH | Adobe Commerce | Incorrect Authorization (CWE-863) |
| CVE-2026-48320 | 8.5 HIGH | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) |
| CVE-2026-48290 | 8.2 HIGH | CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918) |
Showing 20 of 88 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: ColdFusion 2025
- CVE-2026-48320
ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) - CVE-2026-48324
ColdFusion | Improper Neutralization of Special Elements use - CVE-2026-48332
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) - CVE-2026-48318
ColdFusion | Improper Limitation of a Pathname to a Restrict - CVE-2026-48338
ColdFusion | Improper Limitation of a Pathname to a Restrict
同じベンダー: Adobe
- CVE-2026-48295
CAI Content Credentials | Insufficiently Protected Credentia - CVE-2026-48290
CAI Content Credentials | Server-Side Request Forgery (SSRF) - CVE-2026-48296
CAI Content Credentials | Integer Underflow (Wrap or Wraparo - CVE-2026-48357
CAI Content Credentials | Uncontrolled Resource Consumption - CVE-2026-48287
CAI Content Credentials | Untrusted Search Path (CWE-426)
同じ弱点: CWE-863
- CVE-2026-46635
Twig: Sandbox property allowlist bypass via the `column` fil - CVE-2026-47732
Twig Sandbox: multiple `__toString()` policy bypasses via un - CVE-2026-48327
ColdFusion | Incorrect Authorization (CWE-863) - CVE-2026-59889
jackson-databind: @JsonView ypassed for @JsonUnwrapped conta - CVE-2026-48349
Animate | Incorrect Authorization (CWE-863)
V. CVE-2026-48321へのコメント
まだコメントはありません