ColdFusion versions 2025

CVE-2026-48283 is an unauthenticated unrestricted file upload vulnerability in the CKEditor filemanager connector (/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm) that ships by default with every Adobe ColdFusion installation. Affected versions are ColdFusion 2025 Update 9 and earlier and ColdFusion 2023 Update 20 and earlier. An attacker sends a single HTTP POST — no credentials, no user click, no special headers — and drops a malicious .cfm webshell into the ColdFusion webroot via a path traversal in the path parameter. The uploaded file executes as NT AUTHORITY\SYSTEM on Windows. Fixed in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21 (bulletin APSB26-68, released June 30, 2026).

Adobe's CVSS 10.0 CRITICAL rating is essentially correct. The vendor used Scope:Changed (S:C), which is technically debatable since code execution occurs on the same host, yielding a more precise 9.8 with S:U — but in practical terms this is a zero-friction, unauthenticated, internet-reachable RCE that runs as SYSTEM. The sibling flaw CVE-2026-48282 was exploited within *two hours* of the watchTowr writeup and is now KEV-listed. CVE-2026-48283 targets a different, arguably easier attack surface (CKEditor upload vs. RDS FILEIO), meaning weaponization is a matter of days, not weeks. The vendor severity matches reality.

Why this verdict

• Zero authentication friction: AV:N/AC:L/PR:N/UI:N — the attacker needs nothing but HTTP access to the ColdFusion port. No credentials, no social engineering, no prior foothold. This is the lowest-friction attack class possible.
• Default attack surface: The CKEditor filemanager connector with upload.cfm ships with every ColdFusion installation. It is not an optional module or a feature that must be enabled. The endpoint exists out of the box on all affected versions.
• SYSTEM-level execution: Uploaded files execute as NT AUTHORITY\SYSTEM on Windows. This is not constrained to the ColdFusion application sandbox — it is full host compromise with the highest local privilege level.
• Sibling exploitation confirms active targeting: CVE-2026-48282 (same bulletin, same versions, same fix) was exploited within 2 hours of disclosure and is now KEV-listed. Attackers are already probing ColdFusion instances patched by APSB26-68. Weaponization of -48283 is imminent.
• Role multiplier: ColdFusion occupies the application-tier server role in enterprise architectures. It is not a canonical high-value-role component (not a DC, hypervisor, or IdP), but it commonly holds database credentials in neo-datasource.xml with reversible encryption, making it a credential-harvesting pivot point to production databases containing regulated data. In government agencies (ColdFusion's largest vertical), these servers often connect directly to citizen-data stores. The blast radius is host → database tier → regulated data exfiltration. This keeps the floor at HIGH; combined with zero-friction unauth RCE and active campaign context, the verdict remains CRITICAL.
• Historical exploitation pattern: Every prior ColdFusion CKEditor/FCKEditor upload vulnerability (CVE-2018-15961, CVE-2023-26360) was exploited in the wild, often by APT groups. This is a proven, reliable attack class with established tooling.

Why not higher?

A CVSS 10.0 is the mathematical ceiling, and this is already CRITICAL. The minor 0.2-point reduction to 9.8 reflects the debatable Scope:Changed vector — code execution occurs on the same host, not a separate security authority. In every practical dimension this is at the top of the severity scale.

Why not lower?

Despite the relatively small internet-facing population (~800 per Shadowserver), downgrading below CRITICAL would ignore three decisive factors: (1) the attack requires zero authentication and zero user interaction through a default endpoint; (2) the sibling CVE is already KEV-listed with confirmed active exploitation against the same target population; and (3) ColdFusion's historical track record shows 100% exploitation rate for CKEditor upload vulnerabilities. The small external footprint is offset by significant internal deployment in government and financial sectors where ColdFusion is still widely used.

1. Block the CKEditor upload endpoint at the reverse proxy / WAF immediately — Add a deny rule for URI path matching */ckeditor/plugins/filemanager/upload.cfm* on your reverse proxy (Apache, Nginx, IIS ARR) or WAF. This eliminates the attack surface entirely without touching ColdFusion. Deploy within the noisgate mitigation SLA of 3 days for CRITICAL. Test by confirming the endpoint returns 403.
2. Restrict access to the entire /cf_scripts/ directory — The /cf_scripts/ virtual directory serves ColdFusion client-side libraries and the CKEditor connector. Block external access to this path at the network edge. Internal applications that rely on CKEditor rich-text editing will need explicit allowlisting. This is a defense-in-depth measure that also mitigates CVE-2026-48313 and future CKEditor-related issues.
3. Deploy file integrity monitoring on ColdFusion webroot — Configure FIM (OSSEC, Wazuh, CrowdStrike, or Carbon Black) to alert on any new .cfm, .jsp, .jspf, or .war file creation under the ColdFusion wwwroot directory. This provides detection of successful exploitation even if the endpoint block is bypassed. Trigger immediate incident response on any alert.
4. Network-segment ColdFusion hosts away from domain controllers and database tiers — Place ColdFusion servers in a dedicated VLAN with explicit firewall rules allowing only required database ports (e.g., 1433 for MSSQL) and no SMB/RPC/LDAP access to domain controllers. This limits post-exploitation lateral movement and credential relay attacks. Apply within 3 days.
5. Rotate database credentials stored in ColdFusion datasources — After patching, rotate all database passwords configured in the ColdFusion Administrator datasources. These credentials are stored in neo-datasource.xml with reversible encryption that attackers can trivially decrypt with publicly available tools like ColdFusionPwn. Assume they are compromised if the server was exposed.

Run this script from any Linux/macOS workstation (or WSL) that has network access to the target ColdFusion server. Invoke with: bash check_cve_2026_48283.sh https://coldfusion.example.com. No special privileges required — it only performs HTTP requests.

#!/usr/bin/env bash
# check_cve_2026_48283.sh — CVE-2026-48283 ColdFusion CKEditor Upload Check
# Usage: bash check_cve_2026_48283.sh <BASE_URL>
# Example: bash check_cve_2026_48283.sh https://coldfusion.example.com
# Requires: curl
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <BASE_URL>"
  echo "Example: $0 https://coldfusion.example.com"
  exit 2
fi

BASE_URL="${1%/}"
UPLOAD_PATH="/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm"
TARGET="${BASE_URL}${UPLOAD_PATH}"

echo "[*] Checking CVE-2026-48283 against: ${BASE_URL}"
echo "[*] Probing CKEditor upload endpoint: ${TARGET}"

# Step 1: Check if the upload endpoint is reachable
HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 10 "${TARGET}" 2>/dev/null || echo "000")

if [ "${HTTP_CODE}" = "000" ]; then
  echo "[!] Could not connect to ${BASE_URL}"
  echo "UNKNOWN"
  exit 2
fi

if [ "${HTTP_CODE}" = "404" ] || [ "${HTTP_CODE}" = "403" ]; then
  echo "[+] Upload endpoint returned HTTP ${HTTP_CODE} — endpoint blocked or removed."
  echo "[+] This suggests the endpoint is not reachable (patched, WAF-blocked, or hardened)."
  echo "PATCHED"
  exit 0
fi

if [ "${HTTP_CODE}" = "200" ] || [ "${HTTP_CODE}" = "405" ] || [ "${HTTP_CODE}" = "500" ]; then
  echo "[!] Upload endpoint returned HTTP ${HTTP_CODE} — endpoint EXISTS and is reachable!"
  echo "[!] ColdFusion CKEditor filemanager upload.cfm is accessible."
  
  # Step 2: Try to detect ColdFusion version from headers or admin page
  CF_VERSION=$(curl -sk --max-time 10 "${BASE_URL}/CFIDE/adminapi/base.cfc?wsdl" 2>/dev/null | grep -oP 'ColdFusion[^<"]+' | head -1 || echo "")
  if [ -n "${CF_VERSION}" ]; then
    echo "[*] Detected: ${CF_VERSION}"
  fi
  
  echo ""
  echo "[!!!] VULNERABLE — The CKEditor upload endpoint is reachable without authentication."
  echo "[!!!] CVE-2026-48283 is likely exploitable on this host."
  echo "[!!!] ACTION: Apply ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 immediately."
  echo "[!!!] INTERIM: Block /cf_scripts/scripts/ajax/ckeditor/ at your reverse proxy or WAF."
  echo "VULNERABLE"
  exit 1
fi

echo "[?] Unexpected HTTP response code: ${HTTP_CODE}"
echo "UNKNOWN"
exit 2

Sources

1. Adobe Security Bulletin APSB26-68
2. Horizon3.ai — CVE-2026-48283 / CVE-2026-48313 Advisory
3. watchTowr Labs — ColdFusion APSB26-68 Analysis
4. BleepingComputer — ColdFusion flaw exploited in attacks
5. Greenbone — CVE-2026-48282 Active Exploitation
6. The Hacker News — Adobe Patches 7 CVSS 10.0 Flaws
7. Rapid7 — ColdFusion CKEditor File Upload Module
8. CISA KEV — ColdFusion CVE-2026-48282