CVE-2026-48385

The CVSS score for CVE-2026-48385 obscures the real danger: this isn't just OS command injection, it's a privilege boundary escape enabled by a security control bypass on a server that typically runs with elevated OS-level permissions. The "Scope changed" designation is the analytical signal that demands attention — it tells you the attacker breaks out of ColdFusion's security context into the underlying host. ColdFusion applications routinely run under the System account or dedicated service accounts with significant file system and process privileges precisely because the platform's design requires OS-level interaction. A low-privileged user who can trigger command injection to achieve unauthorized write access isn't just defacing a web application — they're likely gaining host-level file write capabilities as a high-privilege process. The "security feature bypass" phrasing suggests this isn't raw command injection in user input, but rather a bypass of some sandboxing, privilege separation, or execution policy that ColdFusion implements. That distinction matters: if there's a control designed to prevent this that was circumvented, the vulnerability is more architectural than incidental. The "low-privileged attacker" framing deserves scrutiny — "low-privileged" likely means someone with CFIDE administrative credentials but not host admin rights, which is still a significant privilege level on most internal networks. ColdFusion's admin interface has a notorious history of being left exposed, using default credentials, or accessible through credential reuse from adjacent web application compromises. That "authenticated user" qualifier reads like a mitigation but in practice is often a much lower bar than it sounds. Examine what ColdFusion's default service privileges are and what the write access actually enables — cron or Task Scheduler manipulation, web root file placement, or configuration overwrite represent different severity and exploitability profiles.

Reviewed through automated stages and approved by a human before publication.