ColdFusion versions 2025

CVE-2026-48282 is a path traversal (CWE-22) in Adobe ColdFusion that lets an unauthenticated remote attacker escape the intended web root and reach arbitrary paths on the host. Adobe's own advisory (APSB26-68) chains the traversal into arbitrary code execution in the security context of the ColdFusion service account. Affected versions are ColdFusion 2025 Update 9 and earlier and ColdFusion 2023 Update 20 and earlier, on every supported OS. Fixed builds are ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, both shipped 2026-06-30.

Vendor severity is CRITICAL / 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That matches reality. ColdFusion is a canonical *high-value-role* application server — it typically fronts the public internet, runs as a privileged service, and holds datasource credentials to production databases. Historical ColdFusion path-traversal / file-upload bugs (CVE-2023-26360, CVE-2023-29298/29300, CVE-2024-20767) all went from advisory to mass exploitation and KEV listing inside weeks. There is no meaningful friction that pulls this below CRITICAL.

Why this verdict

• Unauthenticated + network-reachable + no UI: the entire preconditions list is 'send an HTTP request'. Every friction audit step evaluates to 'attacker already qualifies'.
• Role multiplier — DMZ web/app server: ColdFusion's canonical deployment is internet-facing; a successful chain yields RCE as the service account, which is SYSTEM on most Windows installs. Blast radius is host → datasource → domain within one attack window.
• Role multiplier — high-value-role floor: ColdFusion is not a workstation or lab component; ≥50% of installs occupy the high-value 'public app server' role. Floor is CRITICAL per the deployment-role hard rule.
• Track record: CVE-2023-26360, CVE-2023-29300, CVE-2024-20767 — three consecutive ColdFusion CVEs of this class hit KEV within weeks. Base rate of exploitation is ~100%.
• Adobe Priority 1: Adobe reserves Priority 1 for 'higher risk of being targeted, exploit imminent'. Trust the vendor when they escalate their own scoring.

Why not higher?

Already at CRITICAL / 9.6. Reserving the last 0.4 points because no public PoC or in-the-wild exploitation is confirmed at 2026-07-03 — if either lands, this becomes a hard 10.0 with 'patch within hours' guidance.

Why not lower?

There is no friction to justify a downgrade. Every attempted narrowing (WAF, segmentation, hardened service account) is optional and demonstrably fails in the majority of ColdFusion installs history has shown compromised. EPSS is low only because the CVE is 3 days old; forward-looking exploitation probability is near-certain.

1. Take internet-facing ColdFusion offline or WAF-gate immediately — Until you've applied Update 10 / 21, block all inbound HTTP(S) to ColdFusion from the internet, or enforce a WAF rule that rejects requests containing .., %2e%2e, %252e, ..%2f, ..%5c, and requests to /CFIDE/administrator/* from non-admin source IPs. Per noisgate mitigation SLA for CRITICAL, deploy within 3 days — but given the exploitation track record of this product line, do it today.
2. Apply APSB26-68 patches: ColdFusion 2025 Update 10 or 2023 Update 21 — This is the only durable fix. Test in staging Monday, deploy production by end of week. noisgate remediation SLA for CRITICAL: within 90 days, but given the history of ColdFusion CVE weaponization inside 30 days, target production in 7-14 days.
3. Rotate all ColdFusion datasource credentials, RDS passwords, and admin hashes — Assume neo-security.xml, seed.properties, and password.properties may already have been exfiltrated. Rotate DB creds referenced by CF datasources, CF admin password, RDS password, and any scheduled-task credentials. Complete within the 3-day mitigation window.
4. Enable enhanced Coldfusion admin lockdown per Adobe Lockdown Guide — Restrict the CFIDE administrator and RDS endpoints via web-server-level ACL, disable the RDS service on production, and enforce the sandboxing model. This won't stop the CVE alone but shrinks the useful post-exploit surface.
5. Hunt retroactively for indicators of prior traversal exploitation — Even though Adobe reports no ITW at disclosure, search 90 days of web logs for requests containing traversal encodings against .cfm/.cfc endpoints, and EDR-hunt for coldfusion.exe/java spawning shells or writing .cfm/.jsp files under the webroot.

Run this on each Windows ColdFusion host as a local Administrator, e.g. powershell -ExecutionPolicy Bypass -File Check-CVE-2026-48282.ps1 -CFHome 'C:\ColdFusion2023'. It parses cfusion\lib\version.properties to determine installed version/update and compares to the fixed builds from APSB26-68. Output: VULNERABLE, PATCHED, or UNKNOWN.

#requires -Version 5.0
# Check-CVE-2026-48282.ps1
# Detects Adobe ColdFusion 2025 <= U9 or 2023 <= U20 (APSB26-68)
param(
    [string]$CFHome = 'C:\ColdFusion2023'
)

$ErrorActionPreference = 'Stop'

function Exit-With($code, $msg) {
    Write-Host $msg
    exit $code
}

$versionFile = Join-Path $CFHome 'cfusion\lib\version.properties'
if (-not (Test-Path $versionFile)) {
    # Try 2025 default path
    $alt = 'C:\ColdFusion2025\cfusion\lib\version.properties'
    if (Test-Path $alt) { $versionFile = $alt }
    else { Exit-With 2 'UNKNOWN: version.properties not found; supply -CFHome' }
}

$props = @{}
Get-Content $versionFile | ForEach-Object {
    if ($_ -match '^\s*([^#=]+)=(.*)$') { $props[$Matches[1].Trim()] = $Matches[2].Trim() }
}

$major = [int]($props['major']  | ForEach-Object { $_ })
$minor = [int]($props['minor']  | ForEach-Object { $_ })
$update = 0
if ($props.ContainsKey('update')) { $update = [int]$props['update'] }
elseif ($props.ContainsKey('hf_release'))  { $update = [int]$props['hf_release'] }

$product = "ColdFusion $major.$minor Update $update"
Write-Host "Detected: $product"

# Fixed builds per APSB26-68
# CF 2025 -> Update 10; CF 2023 -> Update 21
if ($major -eq 2025) {
    if ($update -ge 10) { Exit-With 0 "PATCHED: $product" }
    else { Exit-With 1 "VULNERABLE: $product (need >= Update 10)" }
}
elseif ($major -eq 2023) {
    if ($update -ge 21) { Exit-With 0 "PATCHED: $product" }
    else { Exit-With 1 "VULNERABLE: $product (need >= Update 21)" }
}
elseif ($major -le 2021) {
    Exit-With 1 "VULNERABLE: $product is end-of-core-support; no fix available"
}
else {
    Exit-With 2 "UNKNOWN: unexpected ColdFusion major version $major"
}

Sources

1. Adobe Security Bulletin APSB26-68
2. SecurityWeek — Adobe Patches Critical ColdFusion Vulnerabilities
3. BleepingComputer — Adobe patches seven max severity ColdFusion, Campaign flaws
4. The Hacker News — Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic
5. SOCRadar — Adobe ColdFusion and Campaign Classic Critical RCE
6. SecurityAffairs — Adobe fixed multiple maximum-severity flaws
7. CISA KEV Catalog (baseline reference)
8. Adobe ColdFusion Lockdown Guide