CVE-2026-48386— ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
Quick assessment
Affected
Adobe ColdFusion 2025
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Adobe ColdFusion 2025是美国Adobe公司的一款快速构建及部署动态网页应用的平台。 Adobe ColdFusion 2025 2025.0.11及之前版本和ColdFusion 2023 2023.0.22及之前版本存在加密问题漏洞，该漏洞源于使用有风险或已破损的加密算法，可能导致敏感内存信息泄露。
Possible ATT&CK Techniques 1 AI
T1552.005 · Cloud Instance Metadata APIAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Adobe | ColdFusion 2023 | ≤ 2023.0.22 |
affected |
2023.0.23 |
unaffected | ||
| Adobe | ColdFusion 2025 | ≤ 2025.0.11 |
affected |
2025.0.12 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-48386
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
Source: CVE Program / CVE List V5
Vulnerability Description
ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用已被攻破或存在风险的密码学算法
Source: CVE Program / CVE List V5
Vulnerability Title
Adobe ColdFusion 2025 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Adobe ColdFusion 2025是美国Adobe公司的一款快速构建及部署动态网页应用的平台。 Adobe ColdFusion 2025 2025.0.11及之前版本和ColdFusion 2023 2023.0.22及之前版本存在加密问题漏洞，该漏洞源于使用有风险或已破损的加密算法，可能导致敏感内存信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | ColdFusion 2025 | 0 ~ 2025.0.11 | - |
|
| Adobe | ColdFusion 2023 | 0 ~ 2023.0.22 | - |
|
II. Public POCs for CVE-2026-48386
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48386
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-48386 (1)
Same Patch Batch · Adobe · 2026-08-11 · 52 CVEs total
| CVE-2026-48362 | 10.0 CRITICAL | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Comman |
| CVE-2026-27302 | 10.0 CRITICAL | Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) |
| CVE-2026-71398 | 10.0 CRITICAL | Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) |
| CVE-2026-71384 | 9.6 CRITICAL | ColdFusion | Incorrect Authorization (CWE-863) |
| CVE-2026-71362 | 9.1 CRITICAL | Adobe Commerce | Incorrect Authorization (CWE-863) |
| CVE-2026-48381 | 9.0 CRITICAL | Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL |
| CVE-2026-71386 | 8.8 HIGH | ColdFusion | Cross-site Scripting (XSS) (CWE-79) |
| CVE-2026-71387 | 8.8 HIGH | ColdFusion | Incorrect Authorization (CWE-863) |
| CVE-2026-21273 | 8.7 HIGH | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-48413 | 8.7 HIGH | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) |
| CVE-2026-48441 | 8.6 HIGH | Lightroom Classic | Improper Limitation of a Pathname to a Restricted Directory ('Path Tra |
| CVE-2026-48397 | 8.6 HIGH | Lightroom Classic | Deserialization of Untrusted Data (CWE-502) |
| CVE-2026-34635 | 8.4 HIGH | ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321) |
| CVE-2026-21279 | 8.2 HIGH | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2026-48440 | 8.1 HIGH | ColdFusion | Heap-based Buffer Overflow (CWE-122) |
| CVE-2026-48404 | 7.8 HIGH | Lightroom Classic | Out-of-bounds Write (CWE-787) |
| CVE-2026-48410 | 7.8 HIGH | Lightroom Classic | Out-of-bounds Write (CWE-787) |
| CVE-2026-48405 | 7.8 HIGH | Lightroom Classic | Out-of-bounds Write (CWE-787) |
| CVE-2026-48407 | 7.8 HIGH | Lightroom Classic | Out-of-bounds Write (CWE-787) |
| CVE-2026-47940 | 7.8 HIGH | Lightroom Classic | Integer Overflow or Wraparound (CWE-190) |
Showing top 20 of 52 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: ColdFusion 2025
-
CVE-2026-105897
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) -
CVE-2026-106616
ColdFusion | Improper Restriction of XML External Entity Ref -
CVE-2026-34633
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) -
CVE-2026-106618
ColdFusion | Incorrect Authorization (CWE-863) -
CVE-2026-105994
ColdFusion | Incorrect Authorization (CWE-863)
Same vendor: Adobe
-
CVE-2026-100134
Acrobat for Edge | Out-of-bounds Write (CWE-787) -
CVE-2026-100132
Acrobat for Edge | Out-of-bounds Read (CWE-125) -
CVE-2026-100119
CAI Content Credentials | Improper Input Validation (CWE-20) -
CVE-2026-102501
CAI Content Credentials | Improper Input Validation (CWE-20) -
CVE-2026-100114
CAI Content Credentials | Improper Access Control (CWE-284)
Same weakness: CWE-327
-
CVE-2026-3161
IBM Cloud Pak System Risky Cryptographic Algorithm -
CVE-2026-6930
IBM Concert Software Risky Cryptographic Algorithm -
CVE-2026-59116
Windows Remote Desktop Security Feature Bypass Vulnerability -
CVE-2026-102824
Russh: Missing X25519 zero-point validation in hybrid ML-KEM -
CVE-2026-18104
IBM Db2 Mirror for i is vulnerable to obtain sensitive infor