Attackers are now exploiting CVE-2026-48282, a maximum-severity Adobe ColdFusion vulnerability fixed in Adobe’s June 30 security update, according to vulnerability-intelligence reporting cited by BleepingComputer. The update is no longer just a routine patch event for ColdFusion administrators. Any exposed ColdFusion 2025 or 2023 server that has not moved to the fixed builds should be treated as an incident-triage priority.
Adobe’s APSB26-68 bulletin covers 11 ColdFusion vulnerabilities, including six CVSS 10.0 flaws that can lead to arbitrary code execution. Adobe originally said it was not aware of in-the-wild exploits, but the company assigned the update its highest priority rating and recommended installation as soon as possible. NHS England’s National CSOC later issued a July 3 cyber alert warning that researchers had observed exploitation of CVE-2026-48282 and assessing further exploitation as highly likely.
The practical lesson is straightforward: patching is still the first job, but it is no longer the only job. Administrators should also review logs from the disclosure window onward, verify whether CFIDE or other ColdFusion management paths were reachable, and look for file-read, upload, or traversal attempts that would not appear in an ordinary change-management ticket.
What changed since the bulletin
CVE-2026-48282 is a path-traversal flaw affecting ColdFusion 2025 Update 9 and earlier and ColdFusion 2023 Update 20 and earlier. NVD describes the bug as an improper limitation of a pathname to a restricted directory that can allow arbitrary code execution in the context of the current user, with no user interaction required. Adobe’s fixed versions are ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21.
The first public exploitation reports focused on attempts to read files rather than a confirmed mass-compromise wave. That still matters. File-read probes are often the opening move for confirming vulnerable paths, fingerprinting Windows or Linux hosts, and working out whether an attacker can reach more dangerous file-write or code-execution behavior. Security teams should not wait for a CISA Known Exploited Vulnerabilities listing before checking exposed systems.
The path-traversal issue is also only one part of the ColdFusion patch set. Adobe lists two unrestricted-file-upload vulnerabilities, CVE-2026-48276 and CVE-2026-48283; three improper-input-validation flaws, CVE-2026-48277, CVE-2026-48281, and CVE-2026-48316; and the CVE-2026-48282 path-traversal issue. Each carries a CVSS base score of 10.0 and can result in arbitrary code execution under Adobe’s assessment.
The same update also fixes CVE-2026-48313, a path-traversal flaw that can allow arbitrary file-system reads; CVE-2026-48315, an improper-input-validation issue tied to privilege escalation; CVE-2026-48307, a reflected cross-site scripting issue; CVE-2026-48285, a server-side request forgery flaw; and CVE-2026-48314, a lower-scored path-traversal privilege-escalation issue.
Why ColdFusion exposure is hard to judge
ColdFusion often lives in older enterprise application stacks where ownership is split between application teams, Windows or Linux administrators, and security operations. Some servers are public, some sit behind VPNs, and some are attached to legacy workflows that no longer have a clear owner. That is exactly the kind of environment where a known critical patch can remain incomplete across staging, disaster-recovery, partner-facing, or forgotten internal systems.
The patch analysis from watchTowr Labs also suggests admins should look beyond the CVE labels. The researchers found changes touching file write, file read, file move, file delete, directory creation, directory listing, and upload handling, including blocked extensions and path-traversal checks. Their analysis did not map every code change to a specific CVE with certainty, but it shows why this patch family belongs in a broader server-side exposure review.
For defenders, the key question is not simply whether the installer ran. A ColdFusion server that previously exposed file-management, upload, administrator, or application paths may need a compromise review even after the update is installed. That review should include the web server in front of ColdFusion, any reverse proxy or load balancer logs, ColdFusion application logs, and the directories where the application can write content.
What admins should check now
Start with inventory. Identify every ColdFusion 2025 and 2023 instance, including development, staging, disaster-recovery, partner-facing, and old application servers that may not sit in the main patch-management dashboard. For each instance, verify the exact update level rather than relying on package names or asset tags.
Next, separate internet-facing ColdFusion servers from internal-only systems. Publicly reachable servers should move first, followed by systems that accept file uploads, handle authenticated customer workflows, sit behind weak VPN segmentation, or run with elevated service-account permissions. A ColdFusion server that can write files as a powerful local account deserves special scrutiny even if it is not directly exposed to the public internet.
For logs, search for traversal strings, encoded path separators, unexpected file-read attempts, unusual upload requests, newly written files under web-accessible directories, and requests referencing Windows files such as win.ini or Unix-like paths such as /etc/passwd. Security teams should also look for uploaded templates, unfamiliar archive files, webshell-like filenames, and sudden changes to directories that normally should not receive user content.
Do not ignore hardening work after the update. Adobe recommends supported JDK or JRE builds, updated MySQL Java connector usage where relevant, serial-filter settings for JEE installations, and the ColdFusion lockdown guides. Those steps are not substitutes for patching, but they reduce the blast radius when the next server-side ColdFusion flaw appears.
Do not lose the Campaign Classic patch
Adobe’s June 30 release also included a separate Campaign Classic bulletin for CVE-2026-48286, a CVSS 10.0 incorrect-authorization issue affecting ACC v7 version 7.4.3 build 9396 and earlier on Windows and Linux. The fixed build is 7.4.3 build 9397.
Campaign Classic has a different exposure profile than ColdFusion, but it can sit close to customer data, campaign databases, file stores, and integration workflows. Adobe-hosted instances have already been updated, according to the bulletin, but on-premise and hybrid deployments require customer action. Teams running ACC v7 should confirm build 9397 and review whether campaign servers have broad database, file-system, or integration privileges that would raise the impact of code execution.
Patch, then prove exposure is closed
Adobe is moving security bulletin publication from a monthly rhythm to twice-monthly releases starting July 14, 2026, with bulletins planned for the second and fourth Tuesday of each month. The ColdFusion exploitation timeline shows why that change matters: server-side software is moving into a world where public disclosure, patch analysis, and opportunistic probing can happen inside the same week.
The near-term priority is clear. Patch ColdFusion 2025 to Update 10, patch ColdFusion 2023 to Update 21, update on-premise Campaign Classic to build 9397, and review logs from the disclosure window onward. Then keep these systems in the next twice-monthly patch cycle, because the window between published advisory and real probing is no longer comfortably measured in weeks.
