CVE-2026-47928Patch(adobe / coldfusion)

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch adobe coldfusion systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • coldfusion

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-06-10); latest day: 1
  • 4 total mentions across 3 days

Affected systems

Vendors
Products
coldfusion

2 versions affected across 1 product

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-06-10: 2Mentions · 2026-06-15: 1Mentions · 2026-06-16: 1Patch / Workaround · 2026-06-10: 1Patch / Workaround · 2026-06-15: 1Patch / Workaround · 2026-06-16: 1Technical Details · 2026-06-10: 2Technical Details · 2026-06-15: 1Technical Details · 2026-06-16: 106-1006-1506-16
Signal classification2 categories
Patch
375.0%
Disclosure
125.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-06-102
Disclosure1Patch1
2026-06-151
Patch1
2026-06-161
Patch1
Full discourse4 posts
  • Orizon@OrizonCyber
    Patch

    🚨 CVE-2026-47928 — CVSS 9.6/10 ██████████ ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/GxDorZvR5t

    Post summary

    A high‑severity ColdFusion flaw (CVE‑2026‑47928) has been disclosed, with a patch released and brief technical details provided.

    20010147
    59 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    Adobe ColdFusion hit with a CVSS 10 RCE 🔥 CVE-2026-47928 affects versions 2023.19, 2025.8 and earlier. Improper input validation lets attackers execute arbitrary code. Patch immediately. #ColdFusion #InfoSec https://secalerts.co/vulnerability/CVE-2026-47928 https://t.co/nS4vrRJcFT

    Post summary

    Adobe ColdFusion suffers from a critical CVE-2026-47928 with CVSS 10 that allows remote code execution via improper input validation; urgent patching is required.

    0000075
    836 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2026-47928 (CVSS 9.6) Adobe ColdFusion 2023.19, 2025.8 & earlier vulnerable to arbitrary code execution via improper input validation. No user interaction required. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/4TULFicnc2

    Post summary

    The tweet announces CVE-2026-47928, an arbitrary‑code‑execution vulnerability in Adobe ColdFusion, and urges users to apply the patch immediately.

    0000042
    44 followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨 CRITICAL - Adobe ColdFusion Improper Input Validation (CVE-2026-47928) Adobe ColdFusion suffers from improper input validation, enabling attackers to execute arbitrary code in the context of the current user without any user interaction. This vulnerability could lead to complete system compromise if exploited, with severe implications for web applications relying on ColdFusion for backend processing. The scope of this issue has expanded, increasing its attack surface and urgency for mitigation. 👉 Affected: ColdFusion 2023.19 and earlier, 2025.8 and earlier

    Post summary

    Adobe released a warning about CVE-2026-47928, a critical ColdFusion flaw that allows arbitrary code execution via improper input validation, prompting immediate attention and mitigation, though no PoC, exploit, or patch details are provided.

    0000081
    207 followersView on X
CPE platform detail29 entries

29 of 29 entries

PartVendorProductVersionTarget SWTarget HW
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2023--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--
Appadobecoldfusion2025--

Explore more