CVE-2026-48282 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-30

Added to CISA KEV: 2026-07-07 7 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This vulnerability is in the CISA KEV catalog with confirmed active exploitation. Immediately hunt for indicators of compromise - inspect webroot and CFML directories for unauthorized/newly created .cfm/.cfml files (web shells), review RDS and web server access logs for anomalous path traversal requests, and verify file system integrity.
Apply Adobe security bulletin APSB26-68 patches immediately - upgrade to ColdFusion 2025.10 / 2023.21 or later. This is an emergency, out-of-band priority patch.
If immediate patching is not possible, disable the ColdFusion RDS service and restrict network access to management/development components; place ColdFusion behind a WAF and block path traversal patterns.
Monitor for web shell activity, unexpected outbound connections, new administrative accounts, and lateral movement; rotate credentials and secrets stored on affected servers if compromise is suspected.
Patch priority: EMERGENCY / P0 - patch within 24-48 hours given CVSS 10.0, unauthenticated RCE, and confirmed in-the-wild exploitation.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-48282 is a critical path traversal and arbitrary file write vulnerability affecting the Remote Development Service (RDS) component of Adobe ColdFusion. With a CVSS score of 10.0, this flaw allows unauthenticated remote attackers to bypass directory restrictions and write arbitrary files—including malicious CFML web shells—to the host server, which leads to full Remote Code Execution (RCE). It is a severe security risk, particularly for internet-facing systems, as it provides attackers with immediate and total control over the compromised server.

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild, with reports of limited attacks occurring shortly after disclosure ^[5]^[8].
Threat Actors: While specific named threat actors have not been definitively linked in broad public reports, the nature of the exploit and its active use indicate it is being leveraged for initial access in targeted campaigns ^[1].
PoC Availability: Proof-of-concept code and technical documentation detailing how to exploit the vulnerable RDS FILEIO functionality have been made available in public repositories ^[4]^[6].
Attack Prerequisites: Exploitation is performed over the network, does not require authentication, and does not require user interaction, making it highly dangerous for internet-exposed servers ^[2]^[4].

Affected Products & Patches

Affected Versions: Adobe ColdFusion 2025.9, 2023.20, and all earlier versions ^[7]^[9].
Patches: Adobe resolved this vulnerability in security bulletin APSB26-68, released on June 30, 2026 ^[5]^[9].
Mitigations: Administrators should apply the security updates immediately. If patching is not immediately feasible, disabling the ColdFusion RDS service is the primary recommended mitigation to prevent exploitation ^[2].

Impact

Capabilities: Successful exploitation grants an attacker the ability to write arbitrary files to the server's file system, which is typically used to upload web shells that facilitate complete Remote Code Execution (RCE) ^[1]^[2].
Business Risk: For internet-facing deployments, the business risk is critical, as attackers can achieve full system compromise without needing credentials. This may result in data exfiltration, lateral movement within the network, ransomware deployment, or complete loss of service control ^[3].

Sources

CVE-2026-48282: CVE-2026-48282: Unauthenticated Path Traversal and ...
CVE-2026-48282 is a critical unauthenticated path traversal and arbitrary file write vulnerability in the Remote Development Services (RDS) component of Adobe ColdFusion. The vulnerability allows a remote, unauthenticated attacker to bypass directory boundaries and write arbitrary files, including C…
CVE-2026-48282: Adobe ColdFusion RDS Path Traversal ...
The vulnerability allows an unauthenticated attacker to write arbitrary files anywhere on the server's file system, including the web root, ...
Adobe ColdFusion Flaw CVE-2026-48282
A critical vulnerability (CVE-2026-48282, CVSS 10.0) was disclosed affecting Adobe ColdFusion, allowing attackers to achieve full remote code ...
imbas007/CVE-2026-48282
CVE-2026-48282 is a path traversal vulnerability in Adobe ColdFusion's Remote Development Service (RDS) with a CVSS score of 10.0 (Critical). ... CVE-2026-48282 is a path traversal vulnerability in Adobe ColdFusion's Remote Development Service (RDS) with a CVSS score of 10.0 (Critical). It allows un…
Adobe Security Bulletin
Adobe has released security updates for ColdFusion versions 2025 and 2023. These updates resolves critical and important vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass. Adobe is aware that CVE-2026-48282 has…

🔴 CVE-2026-48282