CVE-2026-48282: Adobe ColdFusion path traversal leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 10.0 with no authentication or user interaction, active exploitation per CISA KEV, and a very short federal remediation deadline make this an emergency patch.

What it is

ColdFusion versions 2025.9, 2023.20 and earlier contain a path traversal flaw (CWE-22) that allows an unauthenticated remote attacker to reach files outside the intended restricted directory, leading to arbitrary code execution in the context of the current user. The scope change and full impact ratings make this a maximum-severity issue for any exposed ColdFusion instance.

Impact

An attacker can execute arbitrary code under the ColdFusion service account, potentially taking full control of the host and any data or credentials it can reach. Because scope is changed, the compromise can extend beyond the vulnerable component.

Attack surface

Reachable over the network via the affected ColdFusion service; the CVSS vector shows no privileges and no user interaction required, so any internet-facing instance is directly exposed.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2026-07-07 with a 2026-07-10 remediation due date, indicating active exploitation; EPSS gives a 30-day probability of 0.42388 (98.6th percentile). No ransomware campaign use is documented.

What to do

• Apply the Adobe ColdFusion update referenced in advisory apsb26-68 immediately, prioritizing internet-facing instances.
• If patching cannot be completed by the CISA due date, follow BOD 26-04 guidance and consider discontinuing use of the exposed product.
• Restrict network access to ColdFusion administrative and application endpoints to trusted sources only.
• Run the ColdFusion service with least privilege and confirm it cannot write to web-accessible directories.
• Review CISA forensics triage requirements and check hosts for signs of prior compromise.

Detection

• Monitor ColdFusion logs and web server access logs for traversal sequences such as ../ or encoded variants in request paths.
• Alert on unexpected file writes or new processes spawned by the ColdFusion service account.
• Hunt for outbound connections or web shells created in ColdFusion web directories after suspicious requests.
• Correlate requests to ColdFusion endpoints with subsequent process creation or file modification events on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.