CVE-2026-48318

The 9.9 CVSSv3.1 score on CVE-2026-48318 will anchor incident responders toward maximum-severity treatment, but the EPSS score of 0.2346 tells a materially different story — exploitation probability sits below the 27th percentile of all scored CVEs. This divergence is the signal that should drive your triage decision, not the anchor. ColdFusion's typical deployment as a backend API layer narrows the practical attack surface considerably. The CVSS vector claims 'no user interaction' and 'network attack vector,' but path-traversal vulnerabilities in ColdFusion only matter when the vulnerable code path is exposed to unauthenticated external callers. Most ColdFusion instances sit behind authentication gateways or serve as internal service-to-service endpoints. Before allocating remediation resources, verify whether your instance actually exposes the path-handling logic to unauthenticated network access — if it doesn't, the 9.9 becomes largely theoretical. The 'scope changed' classification in the CVSS vector warrants scrutiny in ColdFusion's specific context. ColdFusion runs on a Java runtime, and the severity implication is that this traversal escapes the sandbox boundary. But the actual blast radius depends entirely on what credentials the ColdFusion service account holds and what files it can reach. An instance running as SYSTEM with access to datasource configs, deployment credentials, and session keys presents a fundamentally different risk than one running with restricted file permissions. Be aware that this vulnerability likely chains with credential access. The arbitrary file read is rarely terminal — reading configuration files, HMAC secrets, or session tokens from accessible paths frequently enables session hijacking or lateral movement without requiring a second CVE. EPSS may be discounting this because the chaining prerequisites depend on specific deployment configurations that the model weights against. The historical pattern matters here. CVE-2010-2861, CVE-2013-0632, and CVE-2021-21087 all targeted ColdFusion path traversal vectors, and each patch addressed the reported symptom without refactoring the underlying path-resolution architecture. If this CVE shares code lineage with those prior fixes, patching only this specific vector may leave dormant bypass conditions intact — a pattern of incomplete remediation that the historical record supports. Before committing full incident-response resources, prioritize verifying deployment context: is the vulnerable path exposed externally, what credentials does the ColdFusion service account hold, and are configuration or credential files readable at that privilege tier? The EPSS-CVSS gap exists because the exploitation window is narrow or precondition-dependent — interrogate those preconditions before scaling your response.

Reviewed through automated stages and approved by a human before publication.