CISA added a maximum-severity Adobe ColdFusion vulnerability, CVE-2026-48282, to its Known Exploited Vulnerabilities catalog on 7 July 2026, citing evidence of active exploitation. The flaw carries a CVSS score of 10.0, and Federal Civilian Executive Branch agencies were required to remediate it by 10 July under Binding Operational Directive 26-04. Adobe shipped fixes on 30 June, so patched builds have been available since before the KEV listing — the priority now is confirming they are actually deployed on exposed servers.

What the flaw is, at a conceptual level

CVE-2026-48282 is a path-traversal weakness, classified under CWE-22 — improper limitation of a pathname to a restricted directory. In plain terms, the application does not sufficiently constrain how file paths are resolved, so a request can be manipulated to reach files or directories outside the location the application is meant to restrict itself to. On a vulnerable ColdFusion server, that behaviour could lead to arbitrary code execution in the context of the process running ColdFusion, which is why the flaw carries a maximum CVSS score of 10.0.

One detail materially changes who is actually exposed. The weakness sits in ColdFusion's Remote Development Services (RDS) component, a developer-tooling feature that is not enabled by default. Public analysis of the flaw indicates that reaching it also requires RDS authentication to be disabled. That narrows the genuinely vulnerable population well below the raw count of internet-exposed servers — and it points to a concrete mitigation beyond patching: confirm RDS is turned off where it is not needed, and that authentication is enforced where it must run.

That is as far as the useful detail goes here. The mechanism matters for understanding exposure; the working exploit steps do not belong in a defender's briefing, and this advisory withholds them. What defenders need is narrower and more actionable: which versions are affected, and how fast the fix is going on.

Affected versions and the fix

The vulnerability affects Adobe ColdFusion 2025.9, 2023.20 and earlier releases. Adobe addressed it on 30 June in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, published as security bulletin APSB26-68, assigning the update its highest priority rating and urging administrators to apply it promptly. CVE-2026-48282 was one of seven maximum-severity (CVSS 10.0) ColdFusion flaws resolved in that bulletin; of the full set, only CVE-2026-48282 has so far been added to the KEV catalog or flagged as exploited. Adobe's advisory initially stated it was not aware of exploitation of the bugs it disclosed, and was later updated to acknowledge exploitation of CVE-2026-48282 in what the company described as limited attacks.

The exploitation timeline is the part that should concentrate attention. The Canadian Centre for Cyber Security flagged exploitation on 2 July, two days after disclosure. Vulnerability-intelligence firm KEVIntel reported observing exploitation attempts within roughly two hours of a detailed public technical analysis of the flaw being released — a reminder that for internet-facing enterprise software, the window between disclosure and opportunistic scanning is now measured in hours, not weeks. Adobe itself has drawn the same conclusion: the company said it is moving from monthly to twice-monthly security bulletins from 14 July 2026, citing AI-assisted vulnerability discovery that is compressing the gap between disclosure and active exploitation.

How exposed is the estimate — and how exposed are you

Shadowserver has tracked roughly 750 to 800 internet-exposed ColdFusion instances, though that figure carries an important caveat: an external scan cannot tell which of those hosts are already patched, which are honeypots, and — critically for this flaw — which have RDS enabled and unauthenticated. It is a rough measure of attack surface, not a compromise count, and the genuinely vulnerable subset is smaller than the headline number. Treat it as a floor for how many administrators should be checking their build strings and RDS configuration, not as a running tally of victims.

ColdFusion has appeared repeatedly in enterprise vulnerability remediation cycles because of its long deployment life and prevalence in internet-facing legacy applications, and its RDS component in particular has featured in several recent ColdFusion security patches. A single unpatched, exposed instance behind a long-lived application is a disproportionate liability.

What to do now

  • Apply ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21, per Adobe's security bulletin, and verify the running build in the administrator console after restarting the service.

  • Inventory every ColdFusion instance — production, staging and development, including servers behind load balancers or in a DMZ — since the forgotten instance is the one that gets hit.

  • Confirm whether RDS is enabled; disable it where it is not required, and enforce RDS authentication where it must run, since that is the precondition this flaw depends on.

  • Restrict external access to ColdFusion servers where the deployment does not require public exposure.

  • If compromise is suspected, follow CISA's forensic-triage guidance and preserve evidence before remediating, rather than wiping the only record of how entry occurred.

  • Rotate credentials and secrets accessible to the ColdFusion process on any host you cannot confidently rule out as compromised.

Key Takeaways

  • CVE-2026-48282 is a CVSS 10.0 path-traversal flaw (CWE-22) in Adobe ColdFusion that can lead to arbitrary code execution; CISA added it to the KEV catalog on 7 July 2026.

  • FCEB agencies were required to patch by 10 July under BOD 26-04; all organisations running ColdFusion should treat it as urgent.

  • Affected: ColdFusion 2025.9, 2023.20 and earlier. Fixed: ColdFusion 2025 Update 10 and 2023 Update 21 (APSB26-68), released 30 June; it was one of seven CVSS 10.0 ColdFusion flaws in that bulletin.

  • The flaw sits in ColdFusion's RDS component, which is off by default; exploitation also needs RDS authentication disabled — so the genuinely vulnerable set is narrower than the exposed count.

  • Exploitation was reported within about two hours of a public technical analysis (KEVIntel) and flagged by Canada's cyber centre on 2 July; Adobe acknowledges limited attacks.

  • Roughly 750–800 ColdFusion instances are internet-exposed by external scans, but that count cannot distinguish patched, honeypot, or RDS-configured hosts.