CVE-2026-48329: adobe coldfusion Insufficient Session Expiration

Vulnerability summary

CVE-2026-48329 is a low (CVSS 2.7) Insufficient Session Expiration vulnerability in adobe coldfusion. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.2% of scored vulnerabilities.

Timeline

1. 14-07-2026
   PublishedVulnerability first disclosed.
2. 27-08-2026
   Last modifiedVulnerability information updated.

Description

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."