CVE-2026-48282: Adobe ColdFusion CVSS 10.0 RCE Exploited in Wild — Patch Immediately

A maximum-severity remote code execution vulnerability in Adobe ColdFusion is being actively exploited in the wild, and the exploitation window opened within hours of public disclosure. CVE-2026-48282 carries a CVSS 3.1 score of 10.0 — the highest possible — and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 7, 2026, with U.S. federal civilian agencies ordered to patch by July 10, 2026. If you are running Adobe ColdFusion in your environment and haven't applied the fix, you are running a compromised server.

What CVE-2026-48282 Is

The vulnerability is a path traversal flaw in ColdFusion's Remote Development Services (RDS) FILEIO handler, specifically the endpoint /CFIDE/main/ide.cfm?ACTION=FILEIO. Due to insufficient path validation in this endpoint, an unauthenticated attacker can write arbitrary files to any location on the underlying filesystem. In practice, this means a threat actor can drop a web shell, overwrite application configuration, or plant malware — all without needing credentials.

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Every component of that vector is worst-case: network-accessible, no complexity, no privileges required, no user interaction, with scope changes and high impact across confidentiality, integrity, and availability. There is no meaningful barrier between a public-facing ColdFusion server and full compromise.

Affected versions are ColdFusion 2025 update 9 and earlier, and ColdFusion 2023 update 20 and earlier.

How Attackers Are Using It

According to vulnerability intelligence platform KEVIntel, active exploitation began within two hours of public disclosure. Threat actors are not waiting for patch cycles or vulnerability scanner updates — they are running automated exploitation at internet scale the moment a POC surface becomes available.

In active attacks observed by Orca Security and Help Net Security, attackers are using CVE-2026-48282 to deploy web shells to the ColdFusion web root, establishing persistent remote access that survives reboots and application restarts. From an initial foothold via web shell, attackers pivot to credential harvesting (ColdFusion configuration files store database connection strings in plaintext), lateral movement across internal networks, and in several observed cases, ransomware deployment.

The RDS service — the specific vector here — was originally designed for developer access to remote ColdFusion instances. Many production deployments have RDS enabled with authentication disabled for internal tooling convenience. Those deployments are fully unauthenticated attack targets.

Remediation: What to Do Right Now

Adobe released the fix on June 30, 2026 as part of security bulletin APSB26-68, which addressed 11 ColdFusion vulnerabilities in total, including 7 rated CVSS 10.0. The patches are:

• ColdFusion 2025: Upgrade to Update 10 or later
• ColdFusion 2023: Upgrade to Update 21 or later

If immediate patching is not possible in your environment, the following mitigations reduce exposure:

First, disable RDS on any production ColdFusion server. RDS is a development feature — it has no legitimate use on internet-facing production instances. Disabling it eliminates the specific attack vector used in CVE-2026-48282 exploitation.

Second, implement network-level restrictions on access to /CFIDE/ paths. Web application firewalls and reverse proxy rules can block external access to ColdFusion administrative endpoints while you prepare for patching.

Third, audit your ColdFusion web root for unexpected files — particularly .cfm and .jsp files that weren't there before. A web shell deployment is often the first indicator of successful exploitation, and finding it before threat actors escalate their access limits the blast radius significantly.

Finally, rotate credentials for any database connections, LDAP configurations, or API keys stored in ColdFusion configuration files, particularly neo-datasource.xml and neo-query.xml. If a server has been exposed to the internet with RDS enabled and unpatched, those credentials should be considered compromised until proven otherwise.

The Broader Context: Adobe's July 2026 ColdFusion Patch Cycle

APSB26-68 addressed 11 vulnerabilities in ColdFusion, with 7 reaching the maximum CVSS score of 10.0. This is an unusually dense concentration of maximum-severity vulnerabilities in a single patch cycle for a single product. ColdFusion has historically been a high-value target for threat actors — it often runs in enterprise environments with access to back-end databases and internal systems, making it an attractive initial access vector.

Organisations running ColdFusion should treat this not just as a patch-and-move-on event, but as a prompt to assess whether ColdFusion is properly hardened: lockdown mode enabled, RDS disabled in production, administrative interfaces access-controlled, and update cycles automated rather than manual.

How Enforster AI Detects This

Enforster AI's continuous scanning continuously monitors web-facing endpoints for indicators of ColdFusion web shell deployment, anomalous file creation in web roots, and suspicious POST requests to RDS handler paths — the signature patterns of CVE-2026-48282 exploitation. If you had a vulnerable ColdFusion instance and aren't sure whether it was targeted before patching, our DAST scanning can assess your environment for post-exploitation indicators.

Contact us at [email protected] or see Enforster AI for how we can assess whether your ColdFusion environment was targeted.

CVE-2026-48282 is a maximum-severity, zero-authentication vulnerability being actively weaponised at scale — the only acceptable response is immediate patching, followed by a thorough post-exploitation assessment.