Adobe ColdFusion CVE-2026-48282: KEV exploited vulnerability

Confirmed
Discovered Jul 7, 2026

Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. CISA added it to KEV on 2026-07-07, making it an in-scope exploited-vulnerability coverage item.

1
Affected Packages
3
Observables
3
Sources

Defender Action Panel

Triage this incident quickly

Check whether your environment installed affected software, copy the top IOCs, run the tested hunting script when available, then review remediation guidance.

Am I affected?
adobe:coldfusion
Immediate action
Audit locks, CI runners, developer workstations, and credential exposure.
Hunting
Has hunting script
CVE-2026-48282
Adobe
ColdFusion

Analysis

Executive Summary

CVE-2026-48282 is tracked here because CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-07 with a remediation due date of 2026-07-10 [1]. The affected product is Adobe ColdFusion. CISA describes the vulnerability as: Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. [1]

This is not a generic CVE roundup entry. The publish decision is based on KEV status, which is a direct source asserting known exploitation. Vendor, NVD, and product pages are used as enrichment and patch-routing sources, not as the sole proof of exploitation [2].

Key Facts

CVE: CVE-2026-48282

Vendor: Adobe

Product: ColdFusion

Vulnerability name: Adobe ColdFusion Path Traversal Vulnerability

CISA KEV added: 2026-07-07

CISA remediation due date: 2026-07-10

Known ransomware campaign use: Unknown

CWE: CWE-22

Evidence Assessment

  • confirmed: CISA KEV lists CVE-2026-48282 for Adobe ColdFusion and states this class of entry is a known exploited vulnerability [1].
  • confirmed: CISA's required action is to apply vendor mitigations, follow BOD 26-04 risk-prioritized update handling, and discontinue use if mitigations are unavailable [1].
  • confirmed: CISA's notes point defenders to the vendor/product advisory or product page and NVD enrichment for CVE-2026-48282 [2].
  • unknown: The public KEV record does not identify specific victims, exploit timestamps, malware family, attacker infrastructure, or file hashes for this item.
  • confirmed: Affected/fixed version guidance: affected ColdFusion 2025 Update 9, ColdFusion 2023 Update 20, and earlier ColdFusion 2025/2023 updates; fixed/remediated ColdFusion 2025 Update 10 or later and ColdFusion 2023 Update 21 or later. Evidence: NVD's Adobe-sourced CVE description, CPE configuration showing ColdFusion 2025 through update9 and ColdFusion 2023 through update20 as vulnerable, and CISA KEV remediation due date. Adobe APSB26-68 still timed out during direct fetch, so Adobe's page should remain a source to re-check, but the NVD record is Adobe-sourced and enough to clear the version gate.

Affected and Fixed Versions

  • Package/product coordinate: adobe:coldfusion
  • Affected: ColdFusion 2025 Update 9, ColdFusion 2023 Update 20, and earlier ColdFusion 2025/2023 updates
  • Fixed/remediated: ColdFusion 2025 Update 10 or later and ColdFusion 2023 Update 21 or later
  • Version evidence: NVD's Adobe-sourced CVE description and CPE configuration list ColdFusion 2025 through update9 and ColdFusion 2023 through update20 as vulnerable. Adobe APSB26-68 remained difficult to fetch directly during cron, so keep the Adobe source linked for operator verification.

Impact Determination

Analysis table
ClassificationCriteriaRequired evidenceRequired actionClosure condition
Confirmed affectedAdobe ColdFusion asset is present in scope and version/fix state matches ColdFusion 2025 Update 9, ColdFusion 2023 Update 20, and earlier ColdFusion 2025/2023 updates.Asset inventory, product version evidence, vendor advisory mapping, patch records, and exposure records.Apply vendor mitigation or remove exposure; preserve relevant application, web, authentication, and EDR telemetry for the exploitation window.Product is patched or retired, exposure is removed, and post-remediation scans show no vulnerable versions.
Presumed exposedProduct is present but version state, internet exposure, or mitigation status is unknown.CMDB, vulnerability scanner, WAF/proxy logs, EDR inventory, and change tickets.Treat as at-risk until version and mitigation status are proven.Inventory and patch evidence are complete.
Not observedNo asset, package, appliance, or service record references Adobe ColdFusion or CVE-2026-48282.Current asset inventory and vulnerability scan coverage.Keep monitoring KEV and vendor advisories.Coverage timestamp and query scope are archived.

Timeline

  • 2026-07-07: CISA adds CVE-2026-48282 to KEV and sets a remediation due date of 2026-07-10 [1].
  • 2026-07-07: This local refresh creates a conservative Halting Problems research folder and defensive scope scanner for adobe-coldfusion-cve-2026-48282-kev.

Remediation Guidance

For Adobe ColdFusion, remediation should be tied to the vendor source listed by CISA, not a generic patch checklist. The minimum closure packet is: the vendor advisory consulted, affected assets enumerated, version or mitigation evidence recorded, internet exposure checked, logs preserved for the likely exploitation window, and compensating controls documented when patching is delayed. CISA's KEV due date of 2026-07-10 should drive urgency [1].

Open Questions

  • Re-check Adobe APSB26-68 when reachable and confirm it matches the NVD-derived fixed updates.
  • Are there public exploitation indicators beyond KEV status, such as IPs, hashes, paths, payload names, or campaign names?
  • Which local assets expose Adobe ColdFusion to untrusted networks?
  • Are product logs sufficient to distinguish scanning from successful exploitation?

IOC and Source-Selector Handling

No incident-specific attacker infrastructure, hashes, payload paths, victim list, or campaign attribution is currently published for CVE-2026-48282 in the reviewed public sources. CISA, NVD, vendor, GHSA, MSRC, Adobe, Joomla, and SimpleHelp URLs are retained as source_selectors / hunt_selectors for asset-export matching only; they are not treated as compromise IOCs.

Evidence sources to preserve

  • ColdFusion application and exception logs
  • web server access/error logs in front of ColdFusion
  • WAF/proxy request logs
  • filesystem snapshots of ColdFusion web roots and upload/temp directories
  • EDR process/file telemetry for ColdFusion service accounts

Product-specific hunts

  • Search for path traversal-like requests and unexpected template/file reads or writes in ColdFusion-fronted routes.
  • Review new or modified CFM/JSP/ZIP/archive files under web-accessible directories and ColdFusion temp/upload paths.
  • Correlate ColdFusion service account process execution with unexpected child processes, file writes, or outbound connections.

Containment actions

  • Restrict internet access to affected ColdFusion instances until fixed updates are applied.
  • Snapshot ColdFusion web roots, temp/upload directories, configuration, and logs before cleanup.
  • Rotate credentials accessible to the ColdFusion service account if exploitation or suspicious file access is observed.

Evidence Handling Requirements

  • Record all investigation and remediation times in UTC and tie them to the CISA KEV added date and due date.
  • Preserve forensic copies or snapshots before destructive cleanup when feasible.
  • Record chain of custody: collector, timestamp, source host/service, hash where applicable, storage location, and transfer history.
  • Preserve product logs, reverse proxy/WAF logs, identity/session logs, EDR telemetry, and ticket/change records for the exposure and remediation windows.
  • Record analyst owner, business owner, affected asset identifiers, and whether the asset was internet-exposed.

Strengthened Remediation and Closure Gates

  • Confirm vendor fixed version or documented retirement for every affected asset.
  • Remove or restrict untrusted exposure until the fixed version or mitigation is verified.
  • Perform a post-fix version query or vulnerability scan and archive evidence.
  • Review for exploit success, persistence, suspicious files, unauthorized sessions, credential exposure, and product-specific downstream abuse.
  • Rotate credentials/sessions/secrets when product logs, EDR, or identity telemetry indicate possible unauthorized access.
  • Monitor for product-specific suspicious activity for a documented post-recovery period.

Sources

Timeline

5 of 5 rows

Timeline
DateEventDescriptionSource
Jul 7, 2026DiscoveryDiscovery recorded for Adobe ColdFusion CVE-2026-48282: KEV exploited vulnerability.cisa.gov
Jul 7, 2026First seenFirst seen recorded for Adobe ColdFusion CVE-2026-48282: KEV exploited vulnerability.cisa.gov
Invalid DatePatch or fixPatch or fix recorded for Adobe ColdFusion CVE-2026-48282: KEV exploited vulnerability.cisa.gov
Jul 7, 2026Adobe ColdFusion CVE-2026-48282: KEV exploited vulnerabilityUnknowncisa.gov
Jul 7, 2026DisclosureDisclosure recorded for Adobe ColdFusion CVE-2026-48282: KEV exploited vulnerability.cisa.gov

Affected Software

1 of 1 rows

Affected Software
PackageEcosystemVersion RangeStatusConfidenceSource
adobe:coldfusionenterprise-softwareaffected: ColdFusion 2025 Update 9, ColdFusion 2023 Update 20, and earlier ColdFusion 2025/2023 updates; fixed: ColdFusion 2025 Update 10 or later and ColdFusion 2023 Update 21 or later; evidence: NVD Adobe-sourced CVE description and CPE configuration, CISA KEV recordMalicious90%cisa.gov; nvd.nist.gov; helpx.adobe.com

IOC Clipboard

3 IOCs
commandCVE-2026-48282
commandAdobe
commandColdFusion

Tested Hunting Scripts

1 of 1 rows

Tested Hunting Scripts
TitleLanguageDescriptionRepositorySource
Adobe ColdFusion asset, advisory, and telemetry selector scanPythonDo exported records reference CVE-2026-48282 or Adobe ColdFusion during the KEV remediation window?scripts/adobe_coldfusion_cve_2026_48282_kev_scope_scan.py opens in a new tabcisa.gov

Hunt Manifest: Adobe ColdFusion asset, advisory, and telemetry selector scan

Title
Adobe ColdFusion asset, advisory, and telemetry selector scan
Question
Do exported records reference CVE-2026-48282 or Adobe ColdFusion during the KEV remediation window?
Telemetry Family
Python
Repository
scripts/adobe_coldfusion_cve_2026_48282_kev_scope_scan.py
Show tested hunting scriptscripts/adobe_coldfusion_cve_2026_48282_kev_scope_scan.py
scripts/adobe_coldfusion_cve_2026_48282_kev_scope_scan.py opens in a new tabPython
#!/usr/bin/env python3
"""Defensive scope scanner for CVE-2026-48282 (Adobe ColdFusion).

This script scans exported web, EDR, asset, ticket, or CMDB text/JSON/CSV data for
source and product selectors from the Halting Problems research note. It does not
contact the network and does not execute target artifacts.
"""
from __future__ import annotations

import argparse
import json
import os
from pathlib import Path

CVE_ID = 'CVE-2026-48282'
VENDOR = 'Adobe'
PRODUCT = 'ColdFusion'
VULNERABILITY_NAME = 'Adobe ColdFusion Path Traversal Vulnerability'
SOURCE_DOMAINS = ['www.cisa.gov', 'helpx.adobe.com', 'nvd.nist.gov']
AFFECTED_VERSION_RANGE = 'ColdFusion 2025 Update 9, ColdFusion 2023 Update 20, and earlier ColdFusion 2025/2023 updates'
FIXED_VERSION = 'ColdFusion 2025 Update 10 or later and ColdFusion 2023 Update 21 or later'
PACKAGE_COORDINATE = 'adobe:coldfusion'
SOURCE_URLS = ['https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2026-48282', 'https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html', 'https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk', 'https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk', 'https://nvd.nist.gov/vuln/detail/CVE-2026-48282']
PRODUCT_MARKERS = ['CVE-2026-48282', 'Adobe', 'ColdFusion', 'Adobe ColdFusion Path Traversal Vulnerability']
OUT_DEFAULT = "hp-adobe-coldfusion-cve-2026-48282-kev-scope"
TEXT_EXTENSIONS = {".txt", ".log", ".json", ".jsonl", ".csv", ".tsv", ".yaml", ".yml", ".xml", ".html", ".md"}


def iter_files(root: Path):
    exclude_dirs = {".git", "node_modules", "vendor", "dist", "build", ".venv", "__pycache__"}
    for current, dirs, files in os.walk(root):
        dirs[:] = [d for d in dirs if d not in exclude_dirs]
        for name in files:
            path = Path(current) / name
            if path.suffix.lower() in TEXT_EXTENSIONS or path.stat().st_size < 2_000_000:
                yield path


def read_text(path: Path) -> str:
    try:
        return path.read_text(encoding="utf-8", errors="ignore")
    except OSError:
        return ""


def main() -> int:
    parser = argparse.ArgumentParser(description=f"Scope local exports for {CVE_ID} selectors.")
    parser.add_argument("root", nargs="?", default=".", help="Directory containing exported logs, asset inventory, tickets, or notes.")
    parser.add_argument("--out", default=OUT_DEFAULT, help="Output directory for report.json and matched files list.")
    args = parser.parse_args()

    root = Path(args.root).resolve()
    out = Path(args.out).resolve()
    out.mkdir(parents=True, exist_ok=True)

    indicators = set()
    for group in (SOURCE_DOMAINS, SOURCE_URLS, PRODUCT_MARKERS, [AFFECTED_VERSION_RANGE, FIXED_VERSION, PACKAGE_COORDINATE]):
        for val in group:
            if val:
                indicators.add(str(val))

    hits = []
    for path in iter_files(root):
        text = read_text(path)
        lower = text.lower()
        matched = sorted(ind for ind in indicators if ind.lower() in lower)
        if matched:
            hits.append({"path": str(path.relative_to(root)), "selectors": matched})

    report = {
        "event": {"cve_id": CVE_ID, "vendor": VENDOR, "product": PRODUCT, "vulnerability_name": VULNERABILITY_NAME, "package": PACKAGE_COORDINATE, "affected": AFFECTED_VERSION_RANGE, "fixed": FIXED_VERSION},
        "scan_root": str(root),
        "files_with_hits": len(hits),
        "hits": hits,
        "interpretation": {
            "positive": bool(hits),
            "positive_signal": "At least one exported record references the CVE, product, vendor advisory, CISA KEV, or NVD selector.",
            "next_steps": "Use the matched paths to scope vulnerable assets, confirm patch state, and preserve relevant web/EDR/authentication telemetry for incident review." if hits else "No local selector matches were found in the supplied export; confirm the export covers the affected product inventory and remediation window."
        }
    }
    (out / "report.json").write_text(json.dumps(report, indent=2), encoding="utf-8")
    matched_text = "\n".join(hit["path"] for hit in hits) + ("\n" if hits else "")
    (out / "matched_files.txt").write_text(matched_text, encoding="utf-8")
    print(json.dumps({"cve_id": CVE_ID, "files_with_hits": len(hits), "report": str(out / "report.json")}, indent=2))
    return 1 if False else 0


if __name__ == "__main__":
    raise SystemExit(main())

Provenance & Sources

3 of 3 rows

Provenance & Sources
SourceTypeReliabilityClaimsEvidence
cisa.govSecurity Researcher95%3Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. CISA added it to KEV on 2026-07-07, making it an in-scope exploited-vulnerability coverage item.
nvd.nist.govSecurity Researcher95%1Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. CISA added it to KEV on 2026-07-07, making it an in-scope exploited-vulnerability coverage item.
helpx.adobe.comSecurity Researcher95%1Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. CISA added it to KEV on 2026-07-07, making it an in-scope exploited-vulnerability coverage item.
Adobe ColdFusion CVE-2026-48282: KEV exploited vulnerability — Halting Problems