Adobe ColdFusion Zero-Day: CVSS 10.0, 2-Hour Exploit [2026]
Adobe pushed out a routine-looking security bulletin on Adobe published APSB26-68 on June 30, 2026, patching a critical flaw in ColdFusion; the bulletin addresses multiple issues, including CVE-2026-48282. Ten days later, that same flaw sat on the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, and federal civilian agencies had a three-day window to patch it or pull affected systems offline.
The vulnerability, tracked as CVE-2026-48282, carries a maximum CVSS score of 10.0. Vulnerability-intelligence tracker KEVIntel recorded the first confirmed exploitation attempt within roughly two hours of a technical write-up going public, originating from an India-geolocated IP address. Attackers used it to drop web shells on unpatched servers through a path-traversal bug that needs no authentication and no user interaction at all. Two weeks later, Adobe disclosed a second, closely related flaw affecting the exact same patched versions, meaning administrators who thought they were done in June had more work waiting in July.
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What CVE-2026-48282 Actually Does
CVE-2026-48282 is a path-traversal vulnerability, catalogued under CWE-22, that lets an attacker escape a restricted directory and execute arbitrary code in the context of the running ColdFusion process. Adobe’s own advisory, APSB26-68, lists it alongside several lower-severity issues, but this one stands apart. It requires no privileges, no user clicks, and works remotely over the network, the combination that pushes a CVSS 3.1 score to the theoretical ceiling of 10.0.
The National Vulnerability Database entry confirms the affected builds: ColdFusion 2025 through Update 9 and ColdFusion 2023 through Update 20. Adobe’s fix landed in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. For reference, here is how the two 2026 ColdFusion flaws compare at the vector-string level, straight from NVD’s published records.
CVE-2026-48282 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Base Score: 10.0
CVE-2026-48318 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Base Score: 9.9The only difference between those two strings is a single letter: PR:N versus PR:L. That shift from “no privileges required” to “low privileges required” is the entire gap between a 10.0 and a 9.9. Both still count as maximum-severity bugs by any practical measure.
Timeline: Patch Tuesday to Active Exploitation
The gap between disclosure and real-world attacks keeps shrinking industry-wide, and this incident is a clean case study in just how fast that gap can close. Here is the sequence of events as confirmed by Adobe’s bulletin, NVD records, and CISA’s catalog entry.
- June 30, 2026: Adobe publishes APSB26-68, patching CVE-2026-48282 and stating it was “not aware of any exploits in the wild” for the issues the update addressed.
- Early July 2026: A technical write-up detailing the path-traversal mechanics circulates publicly. KEVIntel logs its first observed exploitation attempt within about two hours of that write-up appearing.
- July 7, 2026: CISA adds CVE-2026-48282 to the Known Exploited Vulnerabilities catalog.
- July 10, 2026: Deadline for federal civilian executive branch agencies to remediate, a three-day window from the KEV listing.
- July 14, 2026: Adobe discloses CVE-2026-48318, a second path-traversal flaw hitting the identical version range the June patch was supposed to close.
That three-day remediation clock is aggressive even by CISA’s recent standards, and it lines up with a pattern the agency has leaned on repeatedly in 2026 for bugs it judges are already under active attack. It leaves almost no room for change-control processes at agencies running legacy ColdFusion applications that nobody wants to touch.
How Attackers Are Breaking In
The attack chain itself is not exotic. Path traversal bugs let an attacker reference files or directories outside the folder a web application is supposed to restrict them to, often by stuffing “../” sequences or encoded equivalents into a request. In ColdFusion’s case, that traversal combines with the ability to write files to a web-accessible location, which converts a directory-escape bug into remote code execution once the attacker drops a web shell and requests it over HTTP.
That is almost word for word how Adobe described a different ColdFusion zero-day back in 2019: “This attack requires the ability to upload executable code to a web-accessible directory, and then execute that code via an HTTP request,” the company said at the time, as reported by SecurityAffairs. Seven years and multiple CVEs later, the underlying weakness pattern hasn’t changed much. What has changed is the speed at which scanners find it.
Adobe’s Patch and the Confidence Gap
Adobe’s June 30 bulletin told customers it had no evidence of in-the-wild exploitation for the flaws it was patching that day. That statement did not age well. Within days, independent trackers were logging live exploitation attempts, and a week later CISA made it official by adding the bug to its KEV catalog, a list reserved specifically for vulnerabilities with confirmed active exploitation.
This is not a new pattern for ColdFusion. Adobe has issued near-identical “aware of a report” language for prior zero-days, including one in 2023: “Adobe is aware of a report that CVE-2023-26360 has been exploited in the wild,” the company said, per coverage from Quorum Cyber. That earlier flaw carried a CVSS score of 8.6, well below the 2026 bug, yet it still landed on CISA’s KEV list. The gap between a vendor’s confidence at patch time and the reality a week later has become a recurring theme in ColdFusion’s security history.
CISA’s Emergency Directive and the Three-Day Federal Clock
Once a flaw lands on the KEV catalog, Binding Operational Directive 22-01 kicks in for federal civilian executive branch agencies, forcing a remediation deadline instead of a suggestion. Security news outlet SecurityWeek reported that “the US cybersecurity agency CISA on Tuesday warned that vulnerabilities in Adobe ColdFusion, Langflow, and two Joomla extensions have been exploited in the wild,” grouping the ColdFusion bug with several other actively exploited flaws disclosed the same week.
Private-sector organizations face no legal deadline, but the KEV listing functions as a de facto industry alarm. Cyber insurers, compliance auditors, and enterprise security teams increasingly treat KEV inclusion as the line between “patch when convenient” and “patch today.” A three-day federal deadline sends a signal well beyond the agencies it technically binds.
A Second Flaw Two Weeks Later: CVE-2026-48318
On Adobe disclosed CVE-2026-48313 on June 30, 2026; it is a path-traversal issue leading to arbitrary file system read, not a July 14 disclosure of CVE-2026-48318. It scored 9.9 on CVSS 3.1, just a fraction below its predecessor. The catch: it hit ColdFusion 2025 through Update 10 and ColdFusion 2023 through Update 21, the exact fixed versions from the June patch.
In practical terms, an admin who patched promptly on June 30 and considered the matter closed was still exposed to a new flaw discovered in the same code area two weeks later. Path traversal issues tend to cluster because a single flawed input-sanitization routine often has more than one exploitable edge, and ColdFusion’s July results show that pattern playing out in near real time.
ColdFusion’s Critical Vulnerability History
The 2026 bugs are not an isolated event. ColdFusion has a long, well-documented history of maximum or near-maximum severity flaws that reach active exploitation quickly after disclosure. The table below lines up four of the platform’s most significant CVEs since 2019, using CVSS scores and disclosure dates as recorded in NVD.
| CVE | Disclosed | CVSS | Flaw Type | Outcome |
|---|---|---|---|---|
| CVE-2019-7816 | May 2019 | 9.8 | File upload restriction bypass | Exploited in the wild, led to arbitrary code execution |
| CVE-2023-26360 | March 2023 | 8.6 | Improper access control | Added to CISA KEV, exploited pre-disclosure |
| CVE-2026-48282 | June 30, 2026 | 10.0 | Path traversal to RCE | Exploited within hours, added to CISA KEV July 7 |
| CVE-2026-48318 | July 14, 2026 | 9.9 | Path traversal, arbitrary file read | Hit the same versions the June patch had just fixed |
Four major CVEs across seven years might not sound like much on its own. What stands out is the consistency: every single one of these flaws reached confirmed in-the-wild exploitation, and three of the four made CISA’s KEV catalog. Few enterprise platforms carry that batting average.
Who’s Still Running ColdFusion in 2026
ColdFusion is not the ubiquitous platform it was in the early 2000s, but it hasn’t disappeared either. The Shadowserver Foundation was tracking roughly 750 internet-facing ColdFusion servers at the time exploitation of CVE-2026-48282 was detected, according to reporting from Help Net Security. BleepingComputer’s own count, published around the same window, put the figure closer to 800 exposed instances. Shadowserver itself cautioned that it doesn’t know how many of those servers were actually running a vulnerable version, or had risky legacy features like RDS enabled.
That’s a small number next to the millions of exposed WordPress or Apache instances scanned daily, but exposure count isn’t the whole risk picture. ColdFusion deployments skew toward government portals, university systems, and internal enterprise tools built fifteen or twenty years ago and never fully modernized. Those environments tend to run behind smaller security teams, slower patch cycles, and applications so old that nobody left on staff wants to be the one who breaks them by touching the server.
Historical Context: A Platform That Won’t Die
ColdFusion launched in 1995 and has changed hands twice, from Allaire to Macromedia and then to Adobe when it bought Macromedia in 2005. Two decades later, it’s still an Adobe product line with its own annual release cycle, its own PSIRT bulletins, and its own steady drumbeat of critical patches. That longevity is exactly the problem security researchers keep pointing to. Every year ColdFusion survives is another year of accumulated legacy code, accumulated legacy deployments, and accumulated reasons for IT teams to defer a migration that only gets more expensive to attempt.
The 2019, 2023, and 2026 incidents form a pattern rather than a string of coincidences. Each time, Adobe ships a patch, each time attackers move within days or hours, and each time CISA ends up issuing guidance to a subset of admins who hadn’t already acted. The technology underneath keeps evolving, but the organizational dynamics around who runs ColdFusion and how fast they patch it have proven remarkably stable.
How This Compares to 2026’s Other Maximum-Severity Zero-Days
CVE-2026-48282 lands in the middle of an unusually active year for critical, actively exploited vulnerabilities. Several other 2026 zero-days have hit the same CVSS territory across different vendors, and comparing them side by side shows just how compressed the disclosure-to-exploitation window has become across the industry, not just at Adobe.
| Vendor / Product | CVE | CVSS | Key Detail |
|---|---|---|---|
| Adobe ColdFusion | CVE-2026-48282 | 10.0 | Exploited within roughly 2 hours of a public write-up, 3-day federal deadline |
| SonicWall SMA | CVE-2026-15409 | 10.0 | Exploited for 22 days before a patch was available |
| Splunk | CVE-2026-20253 | 9.8 | 3-day CISA remediation deadline |
| Joomla JCE | CVE-2026-48907 | 10.0 | Roughly 2.5 million sites at risk |
| Windows Netlogon | CVE-2026-41089 | 9.8 | Drew comparisons to the 2020 Zerologon flaw |
Two things jump out. First, four of the five entries hit the top of the CVSS scale at 9.8 or above, a severity clustering that would have been unusual a decade ago and is becoming routine now. Second, ColdFusion’s exploitation timeline of about two hours is the fastest of the group, even faster than SonicWall’s bug, which attackers hammered for 22 days before a fix existed at all. Speed to exploitation, not just severity score, is turning into the metric that actually determines how much damage a given zero-day does.
Market Impact: The Real Cost of Legacy Platforms
Adobe has not disclosed any direct financial impact tied to CVE-2026-48282, and there’s no confirmed victim list attached to the exploitation reports so far. That absence of hard numbers doesn’t mean the incident is free. Every organization still running ColdFusion now faces the same calculation: patch immediately and accept the operational risk of touching a legacy production system on short notice, or delay and accept the risk of running a server that’s already on a public exploited-vulnerabilities list.
That calculation ripples outward. Cyber insurance underwriters have grown more aggressive about asking applicants which legacy platforms they still run, and a KEV listing tied to a product name is exactly the kind of disclosure that shows up on renewal questionnaires. Compliance frameworks that reference the KEV catalog directly, including several federal and state requirements, now treat an unpatched listed CVE as an audit finding rather than a footnote. For a platform like ColdFusion, where the underlying application often took years to build and nobody wants to rewrite it, the practical cost of a zero-day isn’t just the incident response bill. It’s the accelerated pressure to finally budget for a migration that’s been on a five-year roadmap for a decade.
What Security Teams Should Do Right Now
The immediate technical response is straightforward, even if the organizational response rarely is. Security teams running ColdFusion in any capacity should treat this as an active-incident-level priority, not a routine patch cycle item.
- Confirm exact ColdFusion version and update level, since anything before ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 remains exposed to CVE-2026-48282.
- Apply Adobe’s APSB26-68 update immediately, then check for the follow-on fix addressing CVE-2026-48318.
- Review server logs for unexpected file writes in web-accessible directories, a hallmark of the web shell technique tied to this exploitation.
- Restrict or disable Remote Development Services (RDS) if it isn’t actively required, since Shadowserver flagged RDS exposure as an open unknown in its server count.
- Treat any internet-facing ColdFusion instance as a priority asset for network segmentation, limiting its ability to reach sensitive internal systems even if it is later compromised.
None of this is exotic advice. It’s the same guidance security teams have repeated after each of ColdFusion’s prior zero-days. The difference in 2026 is how little time there is to act on it before a scanner finds the gap.
Predictions: Where This Story Goes Next
Based on the pattern established across three ColdFusion incidents in seven years, and the broader 2026 zero-day landscape, a few outcomes look likely from here.
- Expect at least one more ColdFusion CVE disclosure before the end of 2026. Two flaws in the same code path within a single month suggests Adobe’s engineers are still auditing related functions, and audits like that rarely stop at two findings.
- Mass-scanning activity targeting the roughly 750 to 800 exposed servers will likely continue for months, not weeks. Older ColdFusion CVEs have stayed in active scanner toolkits for years after patches shipped, and there’s little reason this one breaks that pattern.
- More organizations will quietly accelerate ColdFusion migration plans rather than announce them, following the same slow abandonment curve seen with other aging enterprise platforms once a maximum-severity bug forces the conversation with leadership.
- Cyber insurers will increasingly name ColdFusion explicitly in renewal questionnaires, the way MOVEit and Citrix products showed up after their own high-profile incidents.
- CISA’s remediation windows will keep compressing rather than lengthening. A three-day deadline was aggressive in past years and is becoming close to standard practice for anything already showing active exploitation.
Frequently Asked Questions
What is CVE-2026-48282?
CVE-2026-48282 is a maximum-severity, CVSS 10.0 path-traversal vulnerability in Adobe ColdFusion that allows unauthenticated, remote arbitrary code execution. Adobe patched it on June 30, 2026, in bulletin APSB26-68.
Which ColdFusion versions are affected?
ColdFusion 2025 through Update 9 and ColdFusion 2023 through Update 20 are vulnerable to CVE-2026-48282. Adobe’s fix arrived in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21.
Has CVE-2026-48282 actually been exploited?
Yes. Vulnerability tracker KEVIntel recorded exploitation attempts within roughly two hours of a technical write-up going public, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on July 7, 2026.
What is CVE-2026-48318 and how does it relate?
CVE-2026-48318 is a separate path-traversal flaw, disclosed July 14, 2026, with a CVSS score of 9.9. It leads to arbitrary file read rather than full code execution, and it affects the same ColdFusion 2025 and 2023 version ranges the June patch had just fixed.
How many ColdFusion servers are exposed to this?
The Shadowserver Foundation tracked roughly 750 internet-facing ColdFusion servers around the time exploitation was detected, while BleepingComputer’s reporting put the figure closer to 800. Neither count confirms how many of those servers were actually running a vulnerable, unpatched build.
Is this the first time ColdFusion has had a zero-day like this?
No. Adobe has patched multiple critical, actively exploited ColdFusion flaws before, including CVE-2019-7816 (CVSS 9.8) and CVE-2023-26360 (CVSS 8.6), both of which also reached CISA’s exploited-vulnerabilities tracking.
What should ColdFusion administrators do immediately?
Confirm the running version, apply APSB26-68 and the subsequent fix for CVE-2026-48318, disable Remote Development Services if not required, check logs for unexpected files in web-accessible directories, and segment any internet-facing ColdFusion server from sensitive internal networks.
Does this affect organizations that don’t run ColdFusion directly?
Indirectly, yes. Vendors, contractors, and third-party portals built on ColdFusion can expose partner organizations even when they never installed the software themselves, which is why supply-chain vendor questionnaires increasingly ask about it by name.
Related Coverage
For ongoing coverage of critical vulnerabilities and exploited CVEs, see Tech Insider’s full cybersecurity category archive.
