ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
Summary
| CVE | CVE-2026-48386 |
|---|---|
| State | PUBLISHED |
| Assigner | adobe |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-11 17:18:00 UTC |
| Updated | 2026-08-13 18:09:25 UTC |
| Description | ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.006960000 probability, percentile 0.499880000 (date 2026-08-15)
Problem Types: CWE-327 | CWE-327 Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Adobe | Coldfusion | 2023 | - | All | All |
| Application | Adobe | Coldfusion | 2023 | update1 | All | All |
| Application | Adobe | Coldfusion | 2023 | update10 | All | All |
| Application | Adobe | Coldfusion | 2023 | update11 | All | All |
| Application | Adobe | Coldfusion | 2023 | update12 | All | All |
| Application | Adobe | Coldfusion | 2023 | update13 | All | All |
| Application | Adobe | Coldfusion | 2023 | update14 | All | All |
| Application | Adobe | Coldfusion | 2023 | update15 | All | All |
| Application | Adobe | Coldfusion | 2023 | update16 | All | All |
| Application | Adobe | Coldfusion | 2023 | update17 | All | All |
| Application | Adobe | Coldfusion | 2023 | update18 | All | All |
| Application | Adobe | Coldfusion | 2023 | update19 | All | All |
| Application | Adobe | Coldfusion | 2023 | update2 | All | All |
| Application | Adobe | Coldfusion | 2023 | update20 | All | All |
| Application | Adobe | Coldfusion | 2023 | update21 | All | All |
| Application | Adobe | Coldfusion | 2023 | update22 | All | All |
| Application | Adobe | Coldfusion | 2023 | update3 | All | All |
| Application | Adobe | Coldfusion | 2023 | update4 | All | All |
| Application | Adobe | Coldfusion | 2023 | update5 | All | All |
| Application | Adobe | Coldfusion | 2023 | update6 | All | All |
| Application | Adobe | Coldfusion | 2023 | update7 | All | All |
| Application | Adobe | Coldfusion | 2023 | update8 | All | All |
| Application | Adobe | Coldfusion | 2023 | update9 | All | All |
| Application | Adobe | Coldfusion | 2025 | - | All | All |
| Application | Adobe | Coldfusion | 2025 | update1 | All | All |
| Application | Adobe | Coldfusion | 2025 | update10 | All | All |
| Application | Adobe | Coldfusion | 2025 | update11 | All | All |
| Application | Adobe | Coldfusion | 2025 | update2 | All | All |
| Application | Adobe | Coldfusion | 2025 | update3 | All | All |
| Application | Adobe | Coldfusion | 2025 | update4 | All | All |
| Application | Adobe | Coldfusion | 2025 | update5 | All | All |
| Application | Adobe | Coldfusion | 2025 | update6 | All | All |
| Application | Adobe | Coldfusion | 2025 | update7 | All | All |
| Application | Adobe | Coldfusion | 2025 | update8 | All | All |
| Application | Adobe | Coldfusion | 2025 | update9 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Adobe | ColdFusion 2025 | affected 2025.0.11 custom | Not specified |
| CNA | Adobe | ColdFusion 2025 | unaffected 2025.0.12 custom | Not specified |
| CNA | Adobe | ColdFusion 2023 | affected 2023.0.22 custom | Not specified |
| CNA | Adobe | ColdFusion 2023 | unaffected 2023.0.23 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| helpx.adobe.com/security/products/coldfusion/apsb26-90.html | [email protected] | helpx.adobe.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.