Glossary term
Remote code execution (RCE)
Remote code execution (RCE) is when an attacker runs code of their choice on another person's system from a distance.
Read more
Exploited vulnerability
Adobe ColdFusion Path Traversal Leading to Code Execution (CVE-2026-48282)
A critical path traversal flaw in Adobe ColdFusion 2025 and 2023 that can lead to arbitrary code execution.
- On CISA KEV
- CVE ID
- CVE-2026-48282
- CVSS
- 10.0 Critical (CVSS v3.1, Adobe as CNA; no CVSS 4.0 score in the record or NVD)
- CISA KEV
- Listed
- Affected product
- Adobe ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier)
- Exploited
- July 2026
- Published
- 30 June 2026 (Adobe bulletin APSB26-68 and CVE record)
In short
CVE-2026-48282 is a critical path traversal flaw in Adobe ColdFusion 2025 and 2023 that can lead to arbitrary code execution. Brandefense Atlas ties it to the ColdFusion RDS file write operation, which it says lets unauthenticated attackers write files when RDS is enabled with authentication disabled. Adobe rates it CVSS 3.1 10.0, and CISA lists it in KEV.
- CVECVE-2026-48282
- ProductAdobe Adobe ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedCheck Whether RDS Is Enabled · Limit Network Access
What it allows
Adobe says ColdFusion 2025 and 2023 contain a path traversal flaw (CWE-22) "that could lead to arbitrary code execution in the context of the current user". Exploitation needs no user interaction, and the scope is changed. Adobe, the CVE numbering authority, rates it CVSS 3.1 10.0 Critical.
The vector is network, low complexity, no privileges, no user interaction and a changed scope. Impact is high for confidentiality, integrity and availability. The CVE record and NVD show no CVSS 4.0 score.
How Atlas Describes the Route
The Brandefense Atlas catalogue entry names the route. The RDS FILEIO WRITE operation lets unauthenticated attackers write arbitrary files when RDS is enabled with authentication disabled. Adobe's record text quoted above does not spell out those conditions.
The researchers at watchTowr published their analysis of Adobe bulletin APSB26-68 on 2 July 2026. They say RDS is not enabled by default. Based on their testing, they say authentication must also be disabled, and they mark that point with a question mark.
watchTowr also says that matching the file write to this CVE is its best guess. watchTowr says the bulletin lists several CVEs, and this page covers CVE-2026-48282 only.
From File Write to Code Execution
Adobe describes the result as arbitrary code execution. In general, a server that lets an attacker write a file of their choice into a folder it serves can be made to run that file. A planted script of this kind is often called a web shell.
That explanation is ours, because the record does not describe the steps. Our remote code execution glossary entry covers the wider class of flaw.
Exploitation Signals for CVE-2026-48282
These are the public signals we checked on 4 November 2026. Each row names its source.
Exploit signals
- CISA KEVYesAdded 7 July 2026, due date 10 July, forensic triage flagged, known ransomware campaign use listed as Unknown4 Nov
- Exploitation in CISA SSVCYesExploitation active, automatable yes, technical impact total8 Jul
- Public GitHub repositoriesYesThree repositories name the CVE, created 6 to 15 July; one describes itself as a lab validation and detection of the RDS file write4 Nov
- Brandefense BlackholeYes21 retrieved posts between 30 June and 20 July, mostly news relays, CVE alert feeds and notices of new GitHub repositories4 Nov
- Atlas catalogueYesCVSS 10, EPSS 0.42, listed as KEV4 Nov
Verdict Listed in CISA KEV since 7 July 2026; CISA's SSVC entry records exploitation as
The repositories are public code of unknown quality, so we do not link them. Our CISA KEV glossary entry explains what the catalog listing means.
Another critical path traversal, the FortiSIEM flaw CVE-2026-106173, shows the same weakness class in a different product. Fortinet and Adobe each rate their flaw Critical.
Who is affected
The CVE record lists two ColdFusion product lines. Each has a last affected update and a first update the record marks as unaffected.
The record does not list ColdFusion 2021 or earlier. The update numbers come from the CVE record, which links to Adobe's bulletin.
watchTowr says the Adobe bulletin also covers other CVEs, so install the latest update for your ColdFusion line rather than a single fix. Our vulnerability management guide describes a patch routine for exposed servers.
Timeline
- 21 May 2026
Adobe reserves CVE-2026-48282.
- 30 Jun 2026
Adobe releases bulletin APSB26-68, and the CVE record is published.
- 2 Jul 2026
watchTowr publishes its analysis of the bulletin and its RDS file write.
- 7 Jul 2026
CISA adds the CVE to its Known Exploited Vulnerabilities catalog with a due date of 10 July.
- 8 Jul 2026
CISA's SSVC entry in NVD records exploitation as active.
What to do
-
Install the Fixed ColdFusion Update
Move ColdFusion 2025 to Update 10 or later and ColdFusion 2023 to Update 21 or later, as the CVE record marks them unaffected. watchTowr says the same bulletin covers other CVEs, so install the latest update for your ColdFusion line rather than a single fix.
-
Check Whether RDS Is Enabled
Find out whether RDS is on for each ColdFusion server, and whether it requires a password. watchTowr says RDS is off by default. We recommend leaving it off wherever it is not needed.
-
Limit Network Access
We recommend keeping ColdFusion administration and RDS endpoints off the open internet and reachable only from trusted management hosts.
-
Look for Unexpected Files
Because the flaw writes files, list script files in web-served folders that were created or changed since 30 June 2026. Treat an unknown file as a sign of compromise and keep it for forensic review.
-
Treat Exposed Servers as Possibly Compromised
CISA added the CVE to KEV on 7 July 2026 with forensic triage flagged. On a server that was exposed and unpatched after that date, we recommend rotating secrets stored on it.
Questions
Is CVE-2026-48282 exploited?
CISA added it to the Known Exploited Vulnerabilities catalog on 7 July 2026. The CISA SSVC entry in NVD records exploitation as active. The catalog lists known ransomware campaign use as Unknown.
Is ColdFusion exposed by default?
watchTowr says RDS is not enabled by default. The Atlas catalogue entry says the file write needs RDS enabled with authentication disabled. Check the setting on each server.
Which ColdFusion updates fix it?
The CVE record marks ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21 as unaffected. Update 9 and Update 20 and earlier are affected.
Is this the only flaw in bulletin APSB26-68?
No. According to watchTowr's analysis, the bulletin lists several CVEs. This page covers CVE-2026-48282, so install the latest update for your ColdFusion line.
Sources
- CVE-2026-48282 Record CVE Program / Adobe CNA
- CVE-2026-48282 NVD
- Known Exploited Vulnerabilities Catalog entry for CVE-2026-48282 CISA
- It's 37 degrees C and all we can think about is ColdFusion: APSB26-68 watchTowr Labs
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.