CVE-2026-48375

The CVSS 6.5 score for CVE-2026-48375 is a red flag that deserves scrutiny before you triage this as 'moderate' and move on. A vulnerability allowing low-privilege users to crash an enterprise ColdFusion instance should score higher — the gap between that capability and the moderate severity suggests either a hidden prerequisite the vector masks or a component so rarely exposed that the true operational risk is being undercounted. The 'low-privilege attacker + DoS outcome' combination is the analytical signal. Incorrect Authorization vulnerabilities typically manifest as broken access control — a user accessing data they shouldn't. This one terminates in denial of service instead, which tells you the vulnerable code path doesn't validate role context before triggering resource-intensive operations or corrupting application state. ColdFusion's role-based security is mature; this flaw almost certainly lives in a built-in service (scheduler, API gateway, datasource connector) where a developer assumed authenticated callers were already authorized for heavy operations. That's the path of least resistance: add a role check at the top, don't trace what happens when an authorized user triggers repeated resource-intensive calls. What makes this actionable: ColdFusion environments accumulate service accounts — scheduler principals, API credentials, integration identities — that are technically low-privilege in the user hierarchy but have elevated access to exactly the built-in services where this flaw likely lives. Audit those service accounts before the patch drops. If any can reach the vulnerable endpoint without additional authentication, your blast radius extends beyond the ColdFusion instance to every system connected through shared connection pools, LDAP directories, or SSO authentication that depends on CF. This also isn't novel. Adobe ColdFusion has a documented pattern of Incorrect Authorization vulnerabilities in built-in services — CVE-2010-3861, CVE-2021-21087, and now this. The architectural pattern (service interfaces with inconsistent authorization depth) recurs because it never gets refactored. Patch this instance, but understand that the pattern will produce more. Your defensive strategy should include application-layer authorization hardening for any service-facing code, not just platform patching.

Reviewed through automated stages and approved by a human before publication.