Adobe ColdFusion Flaw Now Exploited in Attacks — CVE-2026-48282, Seven 10.0s, Patch Now

One of the 10.0 flaws, CVE-2026-48282, is now being exploited in real attacks

Things have changed since the first "no exploitation seen yet" stage. One of these top-severity flaws, CVE-2026-48282 (severity 10.0), began being used in real attacks almost immediately after its details went public, as reported by several government bodies and research organizations. Vulnerability-intelligence firm KEVIntel said that within under two hours of disclosure, its global network of decoy servers (honeypots) captured live exploitation. A honeypot is a monitoring server set up to deliberately lure attackers and record their methods.

In response, the Canadian Centre for Cyber Security (CCCS) and the UK NHS cyber alert team issued advisories. CVE-2026-48282 abuses file-path handling to write a malicious file onto the server and ultimately run any command. Because it allows takeover without a login, treat any unpatched, internet-facing server as liable to be hit at any moment. The monitoring group Shadowserver observes roughly 800 ColdFusion instances exposed on the internet.

In other words, this flaw is no longer "might be exploited someday" — it is already being exploited. Any organization exposing ColdFusion to the outside should carry out the updates listed under "What you should do now" below, literally right away. Past ColdFusion flaws have repeatedly landed on the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog, and on July 7, 2026, CVE-2026-48282 was formally added to it as well — no longer a prediction, but an officially confirmed, actively exploited flaw. Below is the full picture of the flaws and the fix.

A wave of vulnerabilities has been found in Adobe ColdFusion, software widely used as the foundation that runs the web systems of companies and government agencies. Several of them let an attacker take over a server from the outside without logging in. The U.S. National Vulnerability Database (NVD) first recorded 9 ColdFusion flaws dated June 30, 2026, and with later additions the flaws rated a perfect 10.0 out of 10 now number 6 in ColdFusion alone (7 in total including one in the separate product Adobe Campaign Classic). Each requires no login and no user interaction: an attacker can run any command on the targeted server. The representative ID is CVE-2026-48276, published as Adobe security bulletin APSB26-68. As noted above, CVE-2026-48282 among them is already being exploited in real attacks.

ColdFusion has been abused in real attacks again and again, landing repeatedly on the U.S. CISA "Known Exploited Vulnerabilities (KEV) catalog." Flaws like these — "take over without logging in" — tend to be hunted worldwide and automatically right after disclosure, and how fast you respond decides whether you get hit. For any organization running Adobe ColdFusion on its own servers or in the cloud, this is a top-priority issue to act on now.

* "CVSS" is an international scale that rates a flaw's severity out of 10; 10.0 is the maximum. The CVSS values here are the CVSS v3.1 base scores at the time of publication.

Who is at risk, and what is the damage?

The first to go after this are attackers who systematically scan the internet for exposed ColdFusion servers. Because ColdFusion runs websites and business systems, its entry point is often open to the outside. Attackers scan servers worldwide one after another and target any public server running ColdFusion the moment they find it. The most severe flaws here need no login, so any server they can reach becomes a target.

What the attacker does is send in a crafted file or a malicious input and run their own command on the server without passing authentication. Several ColdFusion features process incoming files or strings without checking their contents enough, so operations that should never be allowed get through. A classic method is to upload an attack program as a file and have the server execute it. Once a command gets through, more programs can be pushed in one after another.

Once arbitrary commands can run, the server is effectively taken over. Website defacement, theft of customer and personal data stored in the database, a foothold into other internal systems, and even planting ransomware — the damage spreads fast. The direct targets are the companies and agencies operating ColdFusion, but the ones who ultimately suffer are the ordinary people using those services. In the sense that a server holding your personal data gets hit, this is not only the operators' problem.

What ColdFusion is, and why it concerns so many organizations

Adobe ColdFusion is software (an application server) that serves as the foundation for building and running websites and business apps. A long-lived product first released in 1995, it is still developed by Adobe in generations like "2025" and "2023." Its strength is quickly building database-driven dynamic web pages — contact forms, member sites, internal business systems — in ColdFusion's own language, and it remains widely used in conservative fields such as government, finance, education, and manufacturing.

Some may feel they "don't hear the name much anymore." But precisely because it has been used for so long, ColdFusion persists as a behind-the-scenes system invisible from the front. And these veteran servers that "just keep running" tend to have their updates deferred, which makes them prime targets. ColdFusion has been abused in attacks many times before, and CISA has repeatedly flagged it as actively exploited. The most dangerous situation is "not even knowing whether you have ColdFusion."

The flaws — which ones are dangerous, and how

Sorted by severity, the ColdFusion flaws to watch most are the 6 (all CVSS 10.0) that let an attacker take over a server outright with no login and no user interaction. It was 5 at first; CVE-2026-48316 was added later, making 6. One of them, CVE-2026-48282, is already confirmed exploited in real attacks, as noted above. Here is the full list, followed by what each type does.

Takeover by uploading a file: CVE-2026-48276 / CVE-2026-48283

These two are a type called unrestricted file upload (CWE-434). A file that should never be uploadable (an executable file containing commands) can be sent in, and the server running it leads to takeover. No login and no special interaction are needed — the most classic and reliable takeover method — and both are rated the maximum 10.0.

Commands run via malicious input: CVE-2026-48277 / CVE-2026-48281 / CVE-2026-48316

These three are improper input validation (CWE-20). The check on whether incoming data is safe is too weak, so the server runs commands the attacker slipped in. All are unauthenticated and need no interaction, each rated 10.0. CVE-2026-48316 was not in the original set and was added to the NVD a few days later, bringing the count of "unauthenticated, no-interaction takeover" 10.0 flaws to 6 in ColdFusion alone.

Reaching places you shouldn't: CVE-2026-48282 / CVE-2026-48313

These two are path traversal (CWE-22), abusing path specifications (like "go up one level") to reach locations that should be off-limits. CVE-2026-48282 uses this to write a malicious file onto the server and ultimately run any command, rated 10.0. This CVE-2026-48282 is the one confirmed exploited in real attacks first (see the update at the top). According to the technical analysis by watchTowr Labs, it stems from weak path validation in ColdFusion's development-support feature (RDS). The other, CVE-2026-48313, allows reading files on the server and limited writing, rated 9.3. If config files or credentials are read, that itself becomes the key to the next break-in.

Abuse by luring a click: CVE-2026-48307 / CVE-2026-48315

These two work by getting an administrator or other user to click a malicious link the attacker prepared. CVE-2026-48307 is cross-site scripting (CWE-79) and CVE-2026-48315 stems from improper input handling; both lead to actions or code execution in the victim's browser with the victim's privileges, rated 8.8 and 9.3. Unlike the five above, they need the extra step of "getting someone to click," but the impact grows when staff who handle the admin screen are targeted. The remaining CVE-2026-48285 is a server-side request forgery (SSRF, CWE-918) that makes the server reach internal resources on the attacker's behalf, rated 8.6.

Note that on the same day, June 30, 2026, a separate Adobe product, Adobe Campaign Classic (marketing software used for email delivery and the like), also had a 10.0-severity flaw that runs commands without authentication: CVE-2026-48286 (incorrect authorization, CWE-863). It is a different product from ColdFusion, but organizations using Adobe Campaign Classic (7.4.3 build 9396 and earlier) need to update it as well.

Is my server at risk? A quick situation chart

Your risk depends heavily on whether your ColdFusion is reachable from outside and whether your version is in scope. Match your situation against the chart.

* In scope are ColdFusion 2025 Update 9 (2025.9) and earlier, and the relevant 2023 build (2023.20) and earlier. You can check your version in the admin console's system information. If you run an older generation (such as 2021), confirm its support status as well.

What you should do now

The top priority is to apply Adobe's latest update immediately. These flaws are fixed in ColdFusion 2025 "Update 10" and ColdFusion 2023 "Update 21." Check the Adobe security bulletin APSB26-68 and the update lists for ColdFusion 2025 and ColdFusion 2023, and move to the latest version for your generation. With CVE-2026-48282 already used in real attacks, "at the next scheduled maintenance" is too late. Adobe rated this its top "Priority 1" and urges applying the fix within about 72 hours. This is a do-it-now matter, literally.

If you genuinely cannot update right away, consider a stopgap of making ColdFusion unreachable directly from the internet. If it doesn't need to be public, keep it on the internal network; if it does, restrict source addresses and place a web application firewall (WAF) in front to narrow the attack surface. Reviewing the "lockdown" settings Adobe has long recommended, which disable unneeded features, also helps.

Also check whether you have already been breached. A typical move in ColdFusion attacks is dropping a suspicious externally executable file (a so-called web shell) onto the server. Look for unfamiliar files appearing in public directories and for suspicious traffic or logs. ColdFusion flaws have been used in real attacks before and have landed on the CISA Known Exploited Vulnerabilities (KEV) catalog many times. It's safest to prepare on the assumption that abuse will spread this time too.

Frequently asked questions

Summary

Adobe ColdFusion has a run of flaws that let an attacker take over a server from the outside without logging in. The unauthenticated, no-interaction 10.0 flaws number 6 in ColdFusion alone (7 including one in Campaign Classic), and one of them, CVE-2026-48282, is already being exploited in real attacks right after disclosure. By merely sending a crafted file or malicious input, an attacker can run any command on the server, opening the door to website defacement, leaks of personal data, and a foothold into other systems.

The fix is clear: apply the latest update Adobe released (APSB26-68) immediately (ColdFusion 2025 Update 10, 2023 Update 21). If that's not possible right away, buy time by making ColdFusion unreachable from outside, and check whether you've already been breached. ColdFusion has been targeted again and again, and this time it is no longer "might be targeted someday" but "already being targeted." "It's running, so it's fine" is exactly the trap — acting now is what prevents the damage.

Follow-up: more ColdFusion flaws in the July regular update (APSB26-82)

On July 14, 2026, separately from the emergency CVE-2026-48282 (APSB26-68), Adobe published its regular advisory APSB26-82, fixing a set of ColdFusion vulnerabilities. None of this regular batch has reports of exploitation yet. But ColdFusion is a product where the gap from fix to exploitation is short, so applying everything together is the safe move.

The standout here is CVE-2026-48284 (severity 9.6). With no login, crafted input can lead to code execution on the server running ColdFusion. However, the attack carries the condition that it must reach from an adjacent network (AV:A), so it lacks the "anyone, straight from the internet" ease of 48282. Alongside it, several flaws requiring a login — privilege escalation, path traversal, SQL injection — were fixed at the same time (CVE-2026-48318 through 48327, and others).

The response is simple. Update ColdFusion 2025 to Update 11, and ColdFusion 2023 to Update 22. These are the latest builds that include this regular batch and, of course, the already-exploited CVE-2026-48282 (fixed in the emergency Update 10 / 21). If you are still on Update 10 / 21, going all the way to this latest build is the sure move. You can track exploitation on the CISA KEV dashboard (Japanese).

References

• ・Adobe — Security update available for Adobe ColdFusion (APSB26-68)
• ・NVD — CVE-2026-48276 (CVSS 10.0, unrestricted file upload)
• ・NVD — CVE-2026-48277 (CVSS 10.0)
• ・NVD — CVE-2026-48281 (CVSS 10.0)
• ・NVD — CVE-2026-48282 (CVSS 10.0, path traversal)
• ・NVD — CVE-2026-48283 (CVSS 10.0, unrestricted file upload)
• ・NVD — CVE-2026-48313 (CVSS 9.3, path traversal)
• ・NVD — CVE-2026-48315 (CVSS 9.3)
• ・NVD — CVE-2026-48307 (CVSS 8.8, cross-site scripting)
• ・NVD — CVE-2026-48285 (CVSS 8.6, SSRF)
• ・NVD — CVE-2026-48316 (CVSS 10.0, improper input validation)
• ・NVD — CVE-2026-48286 (Adobe Campaign Classic, CVSS 10.0)
• ・BleepingComputer — Max severity Adobe ColdFusion flaw now exploited in attacks (CVE-2026-48282)
• ・NHS England Digital — Active Exploitation of CVE-2026-48282 in Adobe ColdFusion
• ・watchTowr Labs — Adobe ColdFusion Security Bulletin APSB26-68 (technical analysis)
• ・Adobe — ColdFusion (2025 release) updates
• ・Adobe — ColdFusion (2023 release) updates
• ・CISA KEV dashboard (Japanese)