Adobe ColdFusion RCE (CVE-2026-48282) Under Attack

A maximum-severity flaw in Adobe ColdFusion is being exploited in the wild, and defenders are on the clock. Tracked as CVE-2026-48282 and rated CVSS 10.0, the vulnerability lets a remote, unauthenticated attacker achieve arbitrary code execution on a ColdFusion server. According to Help Net Security and SecurityWeek, exploitation began within hours of public disclosure on July 7, 2026 — by some accounts, within two hours. The US Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal civilian agencies to remediate by July 10, 2026.

For anyone still running internet-facing ColdFusion, this is a patch-now situation.

What the flaw is

CVE-2026-48282 is a path traversal vulnerability in ColdFusion’s Remote Development Services (RDS) feature. RDS is a developer convenience: it lets an IDE — historically ColdFusion Builder, Dreamweaver, or the Eclipse plugin — talk to a running ColdFusion server to browse files and databases during development. It was never meant to be exposed to the open internet.

The bug lets an unauthenticated attacker send a specially crafted HTTP request that writes an arbitrary file to an arbitrary location on the server’s filesystem — including the web root. Drop an executable script into a web-accessible directory, request it, and the attacker has unauthenticated remote code execution (RCE). There is no login step, no user interaction, and no privilege the attacker needs to hold first. That combination — trivial to reach, no authentication, full code execution — is exactly what a 10.0 score is meant to signal.

Security firm Resecurity described the issue as an RDS path traversal leading to RCE, and the pattern is a familiar one for ColdFusion: a feature meant for trusted, local development becomes a full compromise path once it’s reachable from the network.

It was patched, but not everyone patched

Adobe shipped fixes on June 30, 2026, in ColdFusion 2025 update 10 and ColdFusion 2023 update 21. CVE-2026-48282 did not arrive alone: it was part of a batch of nine vulnerabilities Adobe disclosed across ColdFusion and Campaign Classic, seven of which carried the maximum CVSS 10.0 rating. That is an unusually dense cluster of critical, code-execution-class bugs in a single vendor cycle.

The gap between the June 30 patch and the July 7 exploitation is the whole story. Attackers reverse-engineered the fix, wrote a working exploit, and began scanning for unpatched servers within a week — and once one CVE in the batch was public, the rest became roadmaps. This is the same dynamic that makes freshly disclosed CVEs such attractive bait, which attackers have weaponized directly: see our report on ChocoPoC malware hiding in fake GitHub exploit code, where the lure was proof-of-concept exploits for exactly this kind of hot flaw.

Why ColdFusion keeps showing up

ColdFusion is old, but it is not gone. It powers a long tail of enterprise, government, and education web applications — the kind of systems that were built years ago, still work, and rarely get the attention a modern stack does. That profile is precisely what makes it a recurring target: the software is internet-facing, it runs code by design, and the teams operating it are often small, stretched, or inherited the deployment from someone who left.

It also has history. ColdFusion has been the subject of repeated critical, code-execution flaws over the years, several of which ended up in CISA’s KEV catalog after real-world abuse. Attackers know the pattern and watch each patch cycle closely, because a freshly disclosed ColdFusion CVE reliably finds unpatched, exposed servers. RDS fits that story neatly: a feature useful during development, easy to forget in production, and devastating when left reachable.

The uncomfortable reality is that the servers most at risk from CVE-2026-48282 are often the ones least likely to be patched quickly — legacy deployments without a fast maintenance window. That is exactly the gap attackers exploited within hours.

What to do now

The guidance is blunt because the timeline is:

• Patch immediately. Apply ColdFusion 2025 update 10 or ColdFusion 2023 update 21. If you run an older, unsupported ColdFusion release, treat migration as urgent — it will not receive a fix.
• Disable RDS in production. RDS is a development feature. It should be turned off on any production server, and it should never be reachable from the internet. Disabling it removes the attack surface for this specific flaw.
• Lock down network exposure. ColdFusion administration and development endpoints should sit behind a VPN or IP allowlist, not on the open web — a straightforward application of zero-trust principles.
• Hunt for compromise. Because exploitation predates many patch windows, patching alone isn’t enough. Check for unexpected files in web-accessible directories, unfamiliar scheduled tasks, and outbound connections from the ColdFusion host, and assume a server exposed since July 7 may already be touched.

CISA’s July 10 deadline applies to federal civilian agencies, but the KEV listing is a signal for everyone: this flaw is being used against real targets right now.

Not the only critical flaw this week

ColdFusion wasn’t the only serious disclosure in this window. Researchers also detailed Januscape (CVE-2026-53359), a 16-year-old use-after-free bug in the shadow MMU of Linux’s KVM hypervisor. It can be triggered from inside a guest virtual machine to corrupt the host kernel’s memory, ultimately running code as root on the host across both Intel and AMD x86 systems. In a multi-tenant cloud, that breaks the boundary that’s supposed to keep one customer’s VM from touching another’s — an attacker renting a single instance could, in the worst case, crash the host and take down every co-tenant VM on the same machine. Fixes reached the mainline stable kernels on July 4; where patching must wait, disabling nested virtualization (kvm_intel.nested=0 or kvm_amd.nested=0) removes the path for untrusted guests.

Two very different bugs, one theme: the plumbing that everything else runs on — application servers and hypervisors alike — remains a rich target, and a single flaw in it can undo a lot of defense-in-depth built above it. It’s the infrastructure layer that supply-chain and platform security programs exist to protect; for the broader picture, see our guide to software supply-chain security.

What it means

The ColdFusion episode is a textbook case of the modern patch race, compressed. A vendor ships fixes; a batch of maximum-severity CVEs becomes public; attackers turn the patch into an exploit within hours; and the window between “fix available” and “fix applied” becomes the entire attack surface. For defenders, the lesson isn’t that patching failed — it’s that patching speed is now the control that matters most for internet-facing software.

Who’s exposed: any organization running ColdFusion with RDS reachable from the network, and — thanks to Januscape — effectively every operator of shared Linux virtualization until kernels are updated. Both flaws punish the same habit: leaving a powerful, low-level feature enabled and reachable because it was convenient and nothing had gone wrong yet.

What to watch: how quickly the KEV deadline drives remediation, whether exploitation of the other six ColdFusion 10.0 flaws picks up, and how fast cloud providers roll the patched kernels. The uncomfortable through-line, echoed by incidents from ransomware crews to opportunistic scanners like those behind agentic ransomware campaigns, is simple: the time you have between disclosure and exploitation keeps shrinking, and infrastructure that’s “internal but exposed” is where that clock runs out first.