Advisory · CVE-2026-48282
Actively exploited ColdFusion flaw lets attackers run remote code
A CVSS 10.0 path traversal in ColdFusion 2025.9 / 2023.20 and earlier allows unauthenticated remote code execution, and Adobe confirms limited in-the-wild exploitation.
- Vendor
- Adobe
- Product
- ColdFusion
- Identifier / CWE
- CVE-2026-48282
CWE-22 - Action timing
- Jul 28, 2026
Explain it like I’m five
ColdFusion is a hotel clerk who lets you write any room number on the key card envelope, including rooms in the staff wing. Ask for the boiler room and the clerk hands you the keys.
- 01Malicious request
An unauthenticated attacker sends a request with a crafted path that escapes the intended directory.
- 02Traversal succeeds
ColdFusion fails to confine the pathname, reaching files outside the restricted directory.
- 03Code execution
The traversal leads to arbitrary code execution in the context of the ColdFusion service account.
- 04Scope changes
The attack crosses a security boundary, affecting resources beyond the vulnerable component.
What happened
CISA added CVE-2026-48282 to the Known Exploited Vulnerabilities catalog on July 7, 2026. Adobe’s security bulletin APSB26-68 states that the company “is aware that CVE-2026-48282 has been exploited in the wild in limited attacks targeting Adobe ColdFusion.”
ColdFusion 2025 through Update 9 and ColdFusion 2023 through Update 20 are affected by an improper limitation of a pathname to a restricted directory (CWE-22). An unauthenticated attacker can send a crafted request that escapes the intended directory, and exploitation leads to arbitrary code execution in the context of the current user. No user interaction is required, and the vulnerability is scored CVSS 10.0 with changed scope, meaning the attack crosses a security boundary into other components.
APSB26-68 addressed this flaw alongside several other critical ColdFusion vulnerabilities, several also rated CVSS 10.0.
What to do
- Apply the security updates published in APSB26-68 to all ColdFusion 2025 and 2023 servers without delay; treat internet-facing servers as already targeted.
- Hunt for compromise: check for web shells, unexpected CFML files, and anomalous processes running under the ColdFusion service account.
- Review web access and ColdFusion application logs for path traversal patterns in requests predating the patch.
- If compromise cannot be excluded, rebuild the server from a known-clean image and rotate service credentials, database passwords, and any secrets the ColdFusion server could reach.
- Restrict network access to ColdFusion admin endpoints and management interfaces to trusted addresses only.
Management note
Adobe rarely confirms in-the-wild exploitation in its own bulletins, so that sentence should end any debate about patching speed. ColdFusion servers are a recurring target precisely because they tend to be long-lived and internet-facing. Patch now, then assume the interval between disclosure and exploitation was zero and investigate accordingly.