Jul 07, 2026, 05:57 AM
Active exploitation of CVE-2026-48282 in Adobe ColdFusion has just been confirmed. For organizations still running exposed instances, now is the time to review and secure your systems.
The vulnerability is a critical Path Traversal flaw that may lead to Remote Code Execution (RCE). It affects ColdFusion 2025 Update 9 and earlier as well as ColdFusion 2023 Update 20 and earlier.
Adobe has already released patches in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, assigning the vulnerability a CVSS score of 10.0.
What is most concerning is the speed at which exploitation attempts began. Reports indicate malicious activity less than two hours after the public disclosure of technical details, including attempts to perform arbitrary file read and write operations without authentication.
Has anyone observed activity related to CVE-2026-48282 within their environments or identified indicators of compromise associated with this vulnerability?
The vulnerability is a critical Path Traversal flaw that may lead to Remote Code Execution (RCE). It affects ColdFusion 2025 Update 9 and earlier as well as ColdFusion 2023 Update 20 and earlier.
Adobe has already released patches in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, assigning the vulnerability a CVSS score of 10.0.
What is most concerning is the speed at which exploitation attempts began. Reports indicate malicious activity less than two hours after the public disclosure of technical details, including attempts to perform arbitrary file read and write operations without authentication.
Has anyone observed activity related to CVE-2026-48282 within their environments or identified indicators of compromise associated with this vulnerability?