Intel

CVE-2026-48282

Adobe ColdFusion — Adobe ColdFusion Path Traversal Vulnerability

criticalKEV: actively exploitedPoCEPSS 42%

Description

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Source: CISA_KEVNVDADOBE_BULLETINCVELISTV5BSIBSI_CSAF

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2026-48282 carries a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — the maximum possible rating — and sits at the 98.6th EPSS percentile, indicating an exceptionally high probability of active exploitation attempts in the wild. The changed scope (S:C) is the critical differentiator: a successful exploit breaks out of the ColdFusion process context and can affect the underlying host and adjacent network segments, making full infrastructure compromise a realistic outcome. Organisations with internet-facing ColdFusion deployments — common in healthcare, energy, financial services, and public administration sectors covered by NIS2 — should treat this as a P1 incident requiring immediate patch deployment; compensating controls are a temporary bridge only and do not adequately reduce risk at this severity level.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Upgrade ColdFusion 2025 to version 2025.10 or later; ColdFusion 2023 to version 2023.21 or later — verify exact build numbers in the Adobe Security Bulletin for CVE-2026-48282 at helpx.adobe.com/security before deploying.
  • Block internet-facing access to ColdFusion instances: Place all externally reachable ColdFusion servers (default ports 80, 443, 8500, 8300) behind a WAF or firewall ACL; deny direct inbound access from the internet until patch deployment is confirmed.
  • Isolate the ColdFusion Administrator console: Block port 8500 (Admin UI) and RDS port 8300 at the network perimeter — restrict access to dedicated management VLANs only.
  • Inspect running processes and the filesystem: On all affected hosts, search for newly created or modified files outside the ColdFusion webroot (e.g. .cfm webshells under /CFIDE/, /WEB-INF/); review the process tree of the ColdFusion service for unexpected child processes.
  • Rotate all credentials used by ColdFusion: Immediately rotate service account passwords, API keys, and database credentials accessible to the ColdFusion process — treat them as compromised if exploitation cannot be ruled out.
  • Verify network segmentation: Confirm that ColdFusion servers cannot reach internal systems (Active Directory, databases, internal APIs) without firewall enforcement; identify and close lateral movement paths.

Runbook · Step 2

Mitigation layers

  • WAF rule for path-traversal patterns: Block inbound HTTP requests containing sequences such as ../, ..\, %2e%2e%2f, %252e%252e%2f, ..%2f in URL path and query string. Suricata rule sketch: alert http any any -> $COLDFUSION_SERVERS any (msg:"CVE-2026-48282 Path Traversal attempt"; content:"..%2f"; http_uri; nocase; sid:2026482820;).
  • Least-privilege for the ColdFusion service account: Run the ColdFusion process under a dedicated, non-privileged service account with no local administrator rights; restrict filesystem write permissions to the webroot directory only.
  • Disable RDS and lock down CFIDE: Disable Remote Development Services (RDS) in the ColdFusion Administrator unless strictly required; block external access to the /CFIDE/ directory via .htaccess or IIS Request Filtering rules.
  • Network segmentation (KRITIS/NIS2 context): Host ColdFusion servers in a dedicated DMZ; restrict outbound connections from the ColdFusion host to an allowlist of known destinations (database server, SMTP relay) to impede C2 callback traffic.
  • File Integrity Monitoring (FIM): Configure a FIM solution (e.g. Wazuh, Tripwire) to monitor critical directories (/CFIDE/, /WEB-INF/, ColdFusion installation root) and alert on unexpected write operations.

Runbook · Step 3

Detection rules

  • Web server access logs — path-traversal patterns: Search for URL paths containing %2e%2e, %252e, ../, or ..%5c in Apache/IIS/Nginx logs: grep -E '(\.\./|%2e%2e|%252e%252e|\.\.%2f|\.\.%5c)' access.log | grep -i 'coldfusion\|cfide\|cfm'
  • Sysmon EID 1 / EDR — unexpected child processes: Alert when coldfusion.exe or jvm.exe (Windows) or cfusion (Linux) spawns processes such as cmd.exe, powershell.exe, bash, wget, or curl. Sigma shape: ParentImage|endswith: 'jvm.exe' AND Image|endswith: ['cmd.exe','powershell.exe','bash'].
  • New .cfm files outside the webroot: Linux auditd rule: -w /opt/coldfusion/ -p wa -k cfusion_write; Windows: enable filesystem auditing on %CF_ROOT%\wwwroot\ for write operations by the ColdFusion service process.
  • Network telemetry (Zeek/Suricata) — unexpected outbound connections: Flag unexpected outbound TCP connections from the ColdFusion host to external IPs, especially on ports 4444, 1337, or 443 to unknown destinations — indicative of a reverse shell or C2 callback.
  • Windows Event ID 4688 / Linux auditd execve: Monitor process creation events under the ColdFusion service account for commands such as whoami, net user, id, uname — classic post-exploitation reconnaissance activity.

Metrics

Severity
critical
Priority score
234.47
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
10.0
Source: nvd-v3
CVSS v3
10.0
CVSS v4
—
EPSS percentile
98.6 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
42.4 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2026-07-07 00:00 UTC
CWE
CWE-22

Weakness classes (CWE)

  • CWE-22Base

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-08-28 00:17 UTC· psirt@adobe.com
    • Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/48xxx/CVE-2026-48282.json">CVE-2026-48282</a>
    • Reference: https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html
    • Reference: https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html
    • Reference Type: https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html Types: Vendor Advisory
  2. CVE Modified2026-08-28 00:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282
    • Reference Type: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282 Types: US Government Resource
  3. CVE Modified2026-08-24 22:16 UTC· psirt@adobe.com
    • Affected: ColdFusion → ColdFusion 2025, ColdFusion 2023
  4. CVE Modified2026-07-08 05:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-48282","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic… → {"id":"CVE-2026-48282","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic…
  5. CVE CISA KEV Update2026-07-07 22:00 UTC· 9119a7d8-5eab-497f-8521-727c672e3725
    • Date Added: 2026-07-07
    • Due Date: 2026-07-07
    • Required Action: 2026-07-07
    • Vulnerability Name: 2026-07-07

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • adobe

    coldfusion

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2026-48282