Adobe ColdFusion servers running outdated versions are being actively exploited in the wild. CVE-2026-48282, a maximum-severity remote code execution flaw in the Remote Development Services (RDS) subsystem, was weaponized within hours of disclosure. CISA added it to the Known Exploited Vulnerabilities catalog on July 7, 2026. If you administer ColdFusion 2025 or 2023 instances, patch immediately.

Vulnerability Details

Adobe Security Bulletin APSB26-68, released June 30, 2026, addresses eleven CVEs across ColdFusion 2025 and 2023. CVE-2026-48282 stands out: a path traversal in the RDS FileServlet that allows unauthenticated attackers to write arbitrary files as SYSTEM on Windows.

Attribute	Value
CVE ID	CVE-2026-48282
CVSS v3.1	10.0 (Critical)
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Changed
Impact	Confidentiality, Integrity, Availability: High
CISA KEV	Added July 7, 2026
Advisory	APSB26-68
Affected Versions	ColdFusion 2025 Update 9 and earlier; ColdFusion 2023 Update 20 and earlier
Patched Versions	ColdFusion 2025 Update 10; ColdFusion 2023 Update 21

The vulnerability resides in coldfusion.rds.FileServlet.FileWriteOperator. The filename parameter passes directly to java.io.File.getFile() without canonicalization, enabling directory traversal via ../../ sequences. An attacker uploads a CFML webshell to the webroot and achieves code execution as NT AUTHORITY\SYSTEM.

Impact Assessment

Successful exploitation grants full server compromise:

• Initial Access: Unauthenticated RCE via RDS file write
• Privilege Escalation: Service runs as SYSTEM on Windows
• Persistence: Webshell survives reboots; attacker can install backdoors
• Lateral Movement: Compromised server becomes pivot point for internal network
• Data Theft: Access to application databases, configuration files, connected systems

CISA reports confirmed exploitation against U.S. government agencies. The "exploited in two hours" timeline indicates automated weaponization — likely opportunistic scanning for exposed RDS endpoints.

Affected Systems

Any ColdFusion 2025 or 2023 installation meeting these conditions is vulnerable:

1. RDS enabled (disabled by default in recent updates, but often enabled for development)
2. RDS authentication disabled (default in some configurations)
3. Server accessible from attacker-controlled network (internet-facing or internal compromise)

ColdFusion 2021 and earlier are end-of-life and should be considered vulnerable with no patch path.

Mitigation & Patching

Immediate Action (Priority Order)

1. Apply Updates Now

   • ColdFusion 2025: Install Update 10 (released June 30, 2026)
   • ColdFusion 2023: Install Update 21 (released June 30, 2026)
   • Download from Adobe ColdFusion Downloads page

2. If Patching Is Delayed — Disable RDS

   xml

   Restart ColdFusion service after change.

3. Network-Level Mitigation

   • Block port 8500 (default CF admin) and 8501 (secure) at perimeter
   • Restrict RDS endpoints (/CFIDE/main/ide.cfm, /CFIDE/adminapi/*) to trusted IPs only
   • Deploy WAF rules blocking ..\ and ../ in POST bodies to /CFIDE/

4. Verify Patch Installation

   bash

Detection

Log Indicators

Monitor ColdFusion application logs (coldfusion-out.log, application.log) for:

• POST requests to /CFIDE/main/ide.cfm with action=filewrite
• Path traversal sequences in filename parameter: ..\, ../, %2e%2e%2f
• File writes to webroot directories (wwwroot, cf_scripts, CFIDE)

Sigma Rule: ColdFusion RDS File Write Attempt

YARA Rule: ColdFusion Webshell Artifacts

Network Detection (Suricata)

Frequently Asked Questions

Q: Is RDS enabled by default in ColdFusion 2025/2023? A: No. Recent updates ship with RDS disabled by default. However, many administrators enable it for IDE integration (VS Code, CFBuilder) and forget to disable it in production.

Q: Does the patch require a full server restart? A: Yes. The Update 10/21 installers require a ColdFusion service restart. Plan a maintenance window.

Q: Can I mitigate without patching if RDS is required? A: Enable RDS authentication (strong password) and restrict access via IP allowlist. This reduces attack surface but does not eliminate the underlying code flaw — patching remains the only complete fix.

Q: Are there public exploit scripts? A: Yes. Proof-of-concept code circulated within hours of the advisory. watchTowr Labs published detailed root-cause analysis. Expect Metasploit and Nuclei templates within days.

Q: Does this affect ColdFusion running on Linux? A: The RDS file write works on any OS. On Linux the service typically runs as cfusion user, not root. Impact is lower but still allows webshell deployment and application compromise.

Q: How do I know if I'm already compromised? A: Scan webroot for recently modified .cfm/.cfc files with suspicious content (cfexecute, cffile action="write", Runtime.getRuntime().exec()). Check Windows Event Log for 4688 (process creation) from coldfusion.exe spawning cmd.exe or powershell.exe.

Key Takeaways

• Patch immediately: CVE-2026-48282 is actively exploited, CISA KEV-listed, and weaponized within hours
• Disable RDS in production: If you don't need remote debugging, turn it off entirely
• Audit ColdFusion exposure: Shodan shows thousands of internet-facing /CFIDE/ endpoints — many still unpatched
• Deploy detection: Add the Sigma/YARA/Suricata rules above to your SIEM and EDR
• Plan for ColdFusion 2021 EOL: No patches for older versions; migrate to 2023 or 2025

Conclusion

CVE-2026-48282 demonstrates how a single path traversal in a legacy subsystem (RDS) becomes a critical entry point when authentication is optional and the service runs with high privileges. The two-hour exploitation window leaves no margin for delayed patching. Organizations running ColdFusion must treat this as a "drop everything and patch" event — especially those in government, healthcare, and finance sectors where ColdFusion remains prevalent.

---

Sources:

• Adobe Security Bulletin APSB26-68 (June 30, 2026)
• watchTowr Labs: "It's 37°C, And All We Can Think About Is ColdFusion" (July 2, 2026)
• CISA Known Exploited Vulnerabilities Catalog (July 7, 2026)
• NVD CVE-2026-48282
• Rapid7 Vulnerability Database
• The Hacker News: "CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV" (July 7, 2026)