Adobe ColdFusion CVE-2026-48282: Exploited in 2 Hours
Adobe’s ColdFusion platform is back in the headlines, and not for a good reason. On Adobe quietly patched nine critical flaws across ColdFusion and Campaign Classic on June 30, 2026, including CVE-2026-48282, a path traversal bug that scores 10.0 [1][2].0 on the CVSS scale. Attackers didn’t wait long to notice. Within roughly two hours of technical details going public, honeypot sensors run by vulnerability-intelligence firm KEVIntel recorded live exploitation attempts. By July 8, the Cybersecurity and Infrastructure Security Agency had added the flaw to its Known Exploited Vulnerabilities catalog and given federal agencies three days to patch. Security teams running ColdFusion now face a familiar but urgent question: how fast can they close a hole that’s already being used in the wild?
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is CVE-2026-48282? Inside Adobe’s Critical ColdFusion Flaw
CVE-2026-48282 is a path traversal vulnerability, classified by NVD as an “Improper Limitation of a Pathname to a Restricted Directory” flaw. It lives inside ColdFusion’s Remote Development Services (RDS) FILEIO handler, a feature built years ago to let developers upload and edit files on a server remotely. An attacker who reaches an exposed RDS endpoint can send a crafted HTTP request that escapes the intended directory, drops a malicious file, and executes code with the same permissions as the ColdFusion process itself.
The bug carries a CVSS 3.1 base score of 10.0, the maximum possible severity. The scoring vector, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, tells the rest of the story in shorthand: the attack works over the network, requires low complexity, needs no privileges or user interaction, and grants full compromise of confidentiality, integrity, and availability once it lands. According to Adobe’s official security bulletin APSB26-68, the flaw affects ColdFusion 2025 through Update 9 and ColdFusion 2023 through Update 20. Adobe fixed it in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, both released June 30, 2026. The official NVD record confirms the same version range and severity score.
Timeline: From Patch Release to Active Exploitation in Two Hours
Adobe published its fix quietly, bundled with eight other critical flaws disclosed the same day. That part was routine. What happened next wasn’t. Security research firm WatchTowr published a technical breakdown of the flaw, and real-world attacks followed almost immediately. Ryan Dewhurst, founder of vulnerability-intelligence firm KEVIntel, reported that his company’s global honeypot network picked up in-the-wild exploitation attempts in under two hours of the technical write-up going public, an unusually short gap even by 2026 standards, according to BleepingComputer’s reporting.
The Canadian Centre for Cyber Security followed with its own alert confirming open-source reports of active exploitation, a detail captured in Help Net Security’s coverage. On July 7, six days after the patch shipped, CISA invoked Binding Operational Directive 26-04 and gave Federal Civilian Executive Branch agencies until Friday, July 10 to remediate. CISA formally added CVE-2026-48282 to its Known Exploited Vulnerabilities catalog the next day, July 8.
How the RDS Path Traversal Attack Works
The Remote Development Services Backdoor
RDS is a legacy ColdFusion feature designed to let developers connect from local tools to remotely browse, edit, and upload files on a server. It’s the kind of convenience feature that made sense when ColdFusion first shipped and has been a recurring security liability ever since. To exploit CVE-2026-48282, an attacker needs RDS enabled on the target server, with RDS’s own authentication layer switched off. Neither setting is the default. Adobe ships ColdFusion with RDS disabled out of the box.
Why the Default Configuration Matters
That default is the main reason this isn’t a full internet-wide catastrophe. Servers set up carefully, with RDS left off or properly authenticated, aren’t exploitable through this specific path. The problem is how many organizations don’t actually know their own configuration. ColdFusion has a long install base in government portals, healthcare intranets, and enterprise back-office systems built over two decades, often maintained by teams that inherited the server rather than built it. Shadowserver’s internet-wide scans counted roughly 750 to 800 ColdFusion instances directly reachable online during the week the flaw went public, a figure that doesn’t even include servers sitting behind a firewall but still reachable from an already-compromised internal network.
Who’s Exposed: Versions, Sectors, and Server Counts
The affected versions are narrow but widely deployed: ColdFusion 2025 through Update 9, and ColdFusion 2023 through Update 20. Adobe closed the hole in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. Organizations still running ColdFusion 2021 or earlier, versions already past end-of-life support, don’t appear in Adobe’s patch notes at all, which raises its own question about what happens to servers Adobe no longer patches.
Patch adoption tends to move slower in ColdFusion shops than in most modern stacks, largely because ColdFusion applications are older, more customized, and more likely to break during an update. That’s the same dynamic that made the CitrixBleed NetScaler flaw and the SharePoint RCE disclosed earlier this year so damaging. The software sits deep in production, and nobody wants to touch it until they’re forced to.
CISA’s Emergency Directive: A Three-Day Countdown
CISA’s Binding Operational Directive 26-04 sets rules for how fast federal civilian agencies must patch vulnerabilities, based on four factors: whether a bug is in the KEV catalog, how easily it can be automated into mass scanning, how exposed vulnerable assets are on the public internet, and how much control it hands an attacker. CVE-2026-48282 checked every box, and CISA’s three-day window, July 7 to July 10, reflected that urgency. The directive technically binds only federal civilian agencies, but in practice, CISA deadlines function as the industry’s de facto patch clock. Enterprise security teams routinely treat KEV additions as their own internal deadline trigger, whether or not they’re a federal contractor, a pattern documented in BleepingComputer’s report on the directive.
CVE-2026-48282 wasn’t the only flaw added to KEV that week. CISA’s July 8 update also flagged CVE-2026-56290 in Joomla Page Builder (CVSS 10.0), CVE-2026-48908 in JoomShaper’s SP Page Builder (CVSS 10.0), and CVE-2026-55255 in Langflow, the open-source AI orchestration tool (CVSS 6.1), according to The Hacker News. Four unrelated products, four active exploitation campaigns, one single week.
Adobe’s July CVE Batch: The Numbers Behind the Bulletin
Adobe’s APSB26-68 bulletin didn’t patch just one flaw. It closed eight critical holes in ColdFusion and one unrelated bug in Campaign Classic, Adobe’s on-premise marketing automation platform. Six of the nine carried the maximum 10.0 severity score, based on The Hacker News’ breakdown of the full bulletin.
| CVE | Product | CVSS | Vulnerability Type | Status |
|---|---|---|---|---|
| CVE-2026-48282 | ColdFusion | 10.0 | Path traversal (RDS) leading to RCE | Actively exploited, in CISA KEV |
| CVE-2026-48276 | ColdFusion | 10.0 | Unrestricted file upload | Patched |
| CVE-2026-48283 | ColdFusion | 10.0 | Unrestricted file upload | Patched |
| CVE-2026-48277 | ColdFusion | 10.0 | Input validation | Patched |
| CVE-2026-48281 | ColdFusion | 10.0 | Input validation | Patched |
| CVE-2026-48316 | ColdFusion | 10.0 | Input validation | Patched |
| CVE-2026-48313 | ColdFusion | 9.3 | Path traversal (file read) | Patched |
| CVE-2026-48315 | ColdFusion | 9.3 | Input validation | Patched |
| CVE-2026-48286 | Campaign Classic | 10.0 | Incorrect authorization leading to RCE | Patched (on-premise only) |
Researchers Anirudh Anand, Matan Sandori, and the firm 2Bsecure are credited with reporting several of the ColdFusion flaws in this batch, per Adobe’s bulletin. The Campaign Classic bug affects only on-premise deployments of ACC 7.4.3 build 9396 and earlier. Adobe’s own hosted instances were already patched before the public disclosure.
This Isn’t Adobe’s First ColdFusion Fire Drill in 2026
Two weeks after APSB26-68, Adobe’s regular July Patch Tuesday release shipped bulletin APSB26-82, addressing 13 more ColdFusion CVEs, one of them scoring 9.9. Between the two bulletins, Adobe has now shipped fixes for more than 20 critical or near-critical ColdFusion vulnerabilities inside a single month. Zero Day Initiative’s July 2026 patch-cycle review put the broader picture in context: Microsoft alone shipped 621 CVEs that same cycle, Adobe added 88 more across 12 separate bulletins, and the industry-wide total for July hit 709 vulnerabilities. ZDI’s review also noted that 2026’s cumulative CVE count is already on pace to exceed every prior year the organization has tracked Patch Tuesday releases.
That pace matters for ColdFusion administrators specifically. Two critical bulletins inside three weeks means teams that just finished testing and deploying the June 30 fix are already staring down a second round of patching, with less goodwill and less staff bandwidth than the first time around.
The Ransomware Question: Pattern Versus Confirmed Attribution
No ransomware group has publicly claimed a breach tied to CVE-2026-48282 as of this writing. That matters, because the historical pattern for KEV-listed flaws isn’t reassuring. Security firm GreyNoise’s analysis of CISA’s catalog found that 59 vulnerabilities were quietly reclassified as confirmed ransomware use throughout 2025 alone, often with no public announcement attached to the status change. The fastest of those flips took just one day from KEV addition to confirmed ransomware use, the slowest took 1,353 days, and edge or network-facing software, the exact category ColdFusion falls into, accounted for 59 vulnerabilities flipped, as tracked by GreyNoise.
None of that proves CVE-2026-48282 will follow the same path. RDS being disabled by default narrows the realistic attack surface compared with something like CitrixBleed, which needed no special configuration to be exploitable. But the exploitation timeline so far, patch release to technical write-up to live attacks in roughly 48 hours total, tracks closely with how ransomware affiliates have historically moved on other 2026 KEV entries.
Market Impact: What CVE-2026-48282 Costs Enterprises Running ColdFusion
For companies running ColdFusion, the immediate cost isn’t a ransom. It’s the emergency patch cycle itself. ColdFusion deployments are notorious for custom application code that breaks during version upgrades, which means most enterprise patch windows need a testing cycle that IT teams don’t have time for once a KEV clock starts running. Security teams that treat every KEV addition as a fire drill report the same complaint every time: emergency patching pulls engineers off planned work, and the indirect cost of that disruption often outweighs the direct cost of the vulnerability itself.
There’s a second, quieter cost, and it’s reputational. Adobe has now issued critical ColdFusion bulletins in back-to-back cycles, and enterprise architects who were already reconsidering legacy ColdFusion deployments have one more data point favoring migration to a modern application stack. That calculus doesn’t play out over a single news cycle. It plays out over the multi-year budget conversations that decide whether a two-decade-old platform gets replaced or patched again next quarter. This kind of repeated critical disclosure is exactly the pattern enterprises track as part of the broader 2026 cybersecurity threat landscape shaping IT budgets this year.
How CVE-2026-48282 Stacks Up Against 2026’s Other Max-Severity Bugs
CVE-2026-48282 arrived in a year that has been unusually rough for critical, remotely exploitable software flaws. Compared with other 2026 incidents, including the CitrixBleed NetScaler flaw and the SharePoint RCE, ColdFusion’s bug fits a now-familiar pattern: maximum severity score, no user interaction required, and an exploitation window measured in hours rather than weeks. The table below shows the four vulnerabilities CISA added to its KEV catalog in the same week as CVE-2026-48282.
| CVE | Product | CVSS | Vulnerability Type |
|---|---|---|---|
| CVE-2026-48282 | Adobe ColdFusion | 10.0 | Path traversal leading to RCE |
| CVE-2026-56290 | Joomla Page Builder | 10.0 | Unauthenticated file upload leading to RCE |
| CVE-2026-48908 | JoomShaper SP Page Builder | 10.0 | Unrestricted file upload |
| CVE-2026-55255 | Langflow | 6.1 | Authorization bypass via user-controlled key |
The Langflow entry stands out for a different reason. Security firm Sysdig’s analysis of the exploitation campaign against Langflow, an open-source tool for building AI agent workflows, found that attackers were after something other than server control: the API keys and credentials Langflow instances store for connecting to LLM providers. AI orchestration platforms are becoming a distinct category of high-value target precisely because of what they’re connected to, not just what they run.
Historical Context: ColdFusion’s Long Run as an Attacker Favorite
ColdFusion has been a target for roughly as long as it has existed as an enterprise platform. Its RDS feature alone has been the subject of critical CVEs across multiple ColdFusion generations, a pattern that predates most current security teams’ tenure at their own companies. The platform’s server-side scripting model, its history of default-open administrative features in early releases, and its popularity with government and healthcare IT in the early 2000s combined to make it a recurring subject of federal security advisories for two decades.
That history is part of why this disclosure landed differently than a typical zero-day. Security teams who’ve worked with ColdFusion long enough carry their own institutional memory of prior RDS-related incidents, and many organizations disabled RDS specifically because of that history. That’s exactly why Adobe’s own default setting blunted what could have been a far larger event.
Why the Disclosure-to-Exploit Window Keeps Shrinking
The two-hour gap between WatchTowr’s technical write-up and confirmed exploitation isn’t really an outlier anymore. It’s close to the new normal. Automated exploitation tooling, faster proof-of-concept development, and a larger population of opportunistic scanning operations have compressed what used to be a days-long window into a matter of hours. KEVIntel’s honeypot network was built specifically to catch this compression in real time, and its findings on CVE-2026-48282 track with a broader trend security researchers have flagged across 2026: patch release, technical write-up, and live exploitation increasingly happen within the same business day.
That compression changes the math for every security team’s patch policy. A 72-hour patching recommendation, the kind Adobe includes in most of its critical bulletins, assumes defenders get a meaningful head start. When real attacks start within two hours of public disclosure, a 72-hour window isn’t a safety margin. For any team that hasn’t automated its patch pipeline, it’s already too slow.
What Security Teams Should Do Right Now
Patching is the only complete fix, but there are practical steps that cut exposure immediately for teams that can’t roll out an update the same day. The checks below are illustrative starting points. Exact file paths vary by installation, so pair them with Adobe’s official guidance in APSB26-68.
# Confirm whether RDS is enabled on a ColdFusion host
# (run locally on the server, not against a remote target)
grep -i "rds.enabled" {cf_root}/cfusion/lib/neo-runtime.xml
# Review web server logs for requests hitting RDS-related endpoints
grep -E "/CFIDE/(main/ide|adminapi)/" access.log | awk '{print $1}' | sort | uniq -c | sort -rn
# Confirm your current patch level after updating
grep -i "product.version" {cf_root}/cfusion/lib/updates.txt- Confirm your patch level first. Anything below ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 is vulnerable.
- Disable RDS entirely if it isn’t in active use. That single change closes this specific attack path regardless of patch status.
- If RDS must stay on, confirm RDS authentication is enabled and use a strong, unique credential rather than a shared admin password.
- Restrict access to ColdFusion admin and RDS endpoints to internal networks or a VPN, never the open internet.
- Watch outbound traffic from ColdFusion servers for unexpected connections, a common sign of a webshell dropped through a file-upload flaw.
What Happens Next: 5 Predictions for the Weeks Ahead
- The confirmed victim count will likely grow before it shrinks. Honeypot and internet-scanning data typically surfaces newly compromised hosts for two to three weeks after a KEV addition, even as the pool of exposed servers falls with patching.
- A ransomware group will probably name-drop ColdFusion within 30 days. Given how often network-facing RCEs feed directly into extortion campaigns in 2026, a specific claim tying CVE-2026-48282 to a leak-site posting wouldn’t be surprising, even though none exists yet.
- Adobe’s ColdFusion patch cadence will face renewed scrutiny. Two critical bulletins inside three weeks is likely to accelerate conversations enterprise architects are already having about migrating off the platform, not just patching it again.
- The Shadowserver-tracked exposure count should drop sharply, then plateau. Public pressure and CISA’s deadline typically cut internet-facing exposure by more than half within the first month, but a stubborn tail of unpatched, unmonitored servers tends to persist for years, the same pattern seen with older RCEs.
- Cyber insurers will likely keep tightening KEV-linked patching requirements. Following the pattern set after CitrixBleed and other 2026 KEV entries, insurers increasingly treat continued exposure to a KEV-listed CVE weeks after disclosure as grounds to adjust premiums or contest claims tied to that specific vulnerability.
Frequently Asked Questions
What is CVE-2026-48282?
It’s a critical path traversal vulnerability in Adobe ColdFusion’s Remote Development Services feature that lets an unauthenticated attacker upload a malicious file and achieve remote code execution. It carries a CVSS score of 10.0 and affects ColdFusion 2025 through Update 9 and ColdFusion 2023 through Update 20.
Is my ColdFusion server vulnerable to CVE-2026-48282?
You’re only exploitable through this specific flaw if RDS is enabled and RDS authentication is disabled, neither of which is the default configuration. Check your patch level regardless: anything below ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 needs the update no matter your RDS settings.
How do I patch CVE-2026-48282?
Update to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 through Adobe’s standard update mechanism. Full instructions are in Adobe’s security bulletin APSB26-68.
Has CVE-2026-48282 been tied to a specific ransomware group?
Not as of this writing. No group has publicly claimed a breach linked to this CVE, though vulnerabilities in the CISA KEV catalog have a documented history of later being reclassified for confirmed ransomware use, sometimes within days of being added.
Why did CISA issue an emergency directive for this vulnerability?
CVE-2026-48282 met every criterion in CISA’s Binding Operational Directive 26-04: it’s in the KEV catalog, it’s easy to automate at scale, vulnerable servers are exposed to the internet, and successful exploitation hands an attacker full control of the server.
How many ColdFusion servers are exposed to this vulnerability?
Shadowserver’s internet-wide scans counted roughly 750 to 800 ColdFusion instances directly reachable online during the week the flaw became public. That figure doesn’t include internal servers reachable only from inside an already-compromised network.
Is there a workaround if I can’t patch immediately?
Yes. Disabling RDS entirely closes this specific attack path even before you apply the patch. If RDS must remain active, make sure RDS authentication is turned on and restrict access to internal networks only.
What’s the difference between this bulletin and Adobe’s other July 2026 ColdFusion patches?
CVE-2026-48282 was part of Adobe’s APSB26-68 bulletin, released June 30, 2026. Two weeks later, Adobe’s regular July Patch Tuesday release, bulletin APSB26-82, patched 13 additional ColdFusion CVEs, one scoring 9.9. They’re separate bulletins addressing separate flaws, and both point to the same underlying story: ColdFusion is having a rough month.
Related Coverage
