Adobe ColdFusion vulnerabilities and fixes

CVEs that mention Adobe ColdFusion, ranked by priority. 4 tracked.

Adobe ColdFusion has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-07-14. Highest priority: CVE-2026-12257 (score 54/100).

• CVE-2026-12257 CRITICAL 9.3 Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability
• CVE-2026-48338 MEDIUM 6.8 DOWNGRADE ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu
• CVE-2026-48363 HIGH 8.2 DOWNGRADE ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerabil
• CVE-2026-48364 HIGH 8.2 DOWNGRADE ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerabil

FAQ

How do I fix Adobe ColdFusion vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Adobe ColdFusion being exploited right now?

None of the tracked Adobe ColdFusion CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Adobe ColdFusion CVE should I patch first?

CVE-2026-12257 currently ranks highest (54/100): Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability.

← Back to latest CVEs