Loading story…
Brazil's CTIR Gov warned that Adobe ColdFusion is affected by a critical remote code execution flaw, tracked as CVE-2026-48282, that can allow arbitrary code execution on vulnerable servers. The alert says Adobe has released a security update and urges organizations to identify exposed or unsupported ColdFusion deployments and apply the vendor's fixes immediately.
The notice also states that CVE-2026-48282 has been added to CISA's Known Exploited Vulnerabilities catalog, indicating evidence of active exploitation in the wild. CTIR Gov highlighted the urgency for Brazilian REGIC member institutions to remediate the issue, and cited an EPSS score of 3.20% with an 86.59th percentile, underscoring the likelihood of exploitation and the need for rapid patching.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
CTIR Gov published Alerta 55/2026 warning about critical Adobe ColdFusion vulnerability CVE-2026-48282 and urging organizations to identify vulnerable deployments and apply vendor fixes immediately. The notice also emphasized that Brazilian REGIC institutions must urgently remediate vulnerabilities highlighted in alerts and recommendations.
CVE-2026-48282 was listed in the CISA Known Exploited Vulnerabilities catalog, indicating reliable evidence of active exploitation in the wild. The CTIR Gov alert cites this KEV inclusion as part of its warning to defenders.
Adobe published a security update to remediate the critical ColdFusion vulnerability CVE-2026-48282, which can allow arbitrary code execution. The CTIR Gov notice references Adobe bulletin APSB26-68 for remediation details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released security updates for **Adobe ColdFusion** and **Adobe Campaign Classic** to fix multiple vulnerabilities that could let attackers bypass security controls, manipulate files, gain elevated privileges, or execute arbitrary commands. The most severe issue, **`CVE-2026-48276`**, is an unrestricted file upload flaw in ColdFusion with a **CVSS 10.0** rating that can lead to remote code execution, while **`CVE-2026-48315`** is an improper input validation bug rated **CVSS 9.3** that can enable privilege escalation. CISA later added the ColdFusion flaw to its **Known Exploited Vulnerabilities (KEV)** catalog, confirming active exploitation in the wild and elevating the issue to an urgent remediation priority for organizations running internet-facing ColdFusion servers. Reporting on the KEV update said the vulnerability can contribute to full server compromise, and urged defenders to patch affected systems quickly, investigate for signs of compromise, and prioritize exposed web applications and related enterprise platforms over CVSS-only risk scoring.
Aug 11, 2026
Adobe issued urgent ColdFusion updates after multiple severe vulnerabilities were disclosed across ColdFusion 2025 and 2023, including several flaws that can lead to arbitrary code execution. The most serious newly listed issue, **CVE-2026-48362**, is an unauthenticated OS command injection bug rated `CVSS 10.0`, while **CVE-2026-48273** was rated `9.9` for eval injection. Additional high-severity flaws include **CVE-2026-71387** (incorrect authorization, `CVSS 8.8`) and **CVE-2026-71386** (cross-site scripting, `CVSS 8.8`), alongside other issues affecting authorization, memory safety, denial of service, and sensitive memory exposure. Adobe said affected versions include ColdFusion 2025 up to `2025.0.11` and ColdFusion 2023 up to `2023.0.22`, and directed customers to upgrade to **2025.0.12** or **2023.0.23**. The warnings follow earlier reports that attackers rapidly exploited at least one maximum-severity ColdFusion flaw, **CVE-2026-48282**, a path traversal vulnerability that can enable arbitrary code execution without user interaction. Researchers said exploitation began within hours of public disclosure, and Shadowserver data cited **775** internet-exposed ColdFusion instances, highlighting the reachable attack surface. Adobe said it had not observed active exploitation of the latest August issues, but advised administrators to patch immediately, restrict access to the administrative network zone and portal, limit network exposure, monitor logs for unauthorized access attempts, and accelerate remediation as ColdFusion remains a high-value target.
Aug 12, 2026
Adobe ColdFusion is facing active exploitation of **CVE-2026-48282**, a maximum-severity flaw tied to **RDS arbitrary file write** that can be abused without privileges on unpatched servers. The Canadian Centre for Cyber Security warned that open-source reporting indicates in-the-wild attacks, while Adobe has issued security updates and urged administrators to patch immediately because of the high risk of compromise. Affected releases include **ColdFusion 2025.9, 2023.20, and earlier**, and internet scanning data from Shadowserver shows nearly **800** ColdFusion instances exposed online, though the number still vulnerable is unclear. Separate reporting on **CVE-2026-48276** highlights a closely related ColdFusion attack path in which an unauthenticated attacker uploads a malicious **CFML** payload through an unrestricted file-upload weakness, writes a web shell into a web-accessible location, and then triggers it with an HTTP request to gain code execution. That issue was described as critical with a **CVSS v3.1** score reflecting full impact to confidentiality, integrity, and availability, and its documented root causes included poor filename and extension validation and storing uploads under the web root. Public detection content has also appeared for **CVE-2026-48282**, underscoring defender focus on identifying exposed and unpatched ColdFusion systems.
Jul 12, 2026