Loading story…
Attackers are actively exploiting CVE-2026-48282, a maximum-severity Adobe ColdFusion path-traversal vulnerability rated CVSS 10.0. The flaw permits unauthenticated arbitrary file writes that can lead to remote code execution when Remote Development Services (RDS) is enabled with RDS authentication disabled—a non-default configuration. Adobe released patches on June 30, 2026, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on July 7 following exploitation reports and a Canadian Centre for Cyber Security warning. CrowdSec first observed exploitation on July 20 and recorded 107 attacking IP addresses; separate telemetry cited by Previdian recorded 272 attempts across 16 sensors.
ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21 address this flaw and the related arbitrary-file-read vulnerability CVE-2026-48313, which CrowdSec also reports is being exploited. Organizations should prioritize patching exposed ColdFusion servers, verify whether RDS is enabled without authentication, and investigate potentially affected systems for unauthorized file writes and execution. Citrix released NetScaler Web App Firewall signatures version 183 to help mitigate exploitation, but these protections should supplement rather than replace patching. CrowdSec characterized the observed campaign as rapidly reaching Early Exploitation before settling into Limited Exploitation.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
By July 24, CrowdSec had classified activity against CVE-2026-48282 as Early Exploitation, four days after its first observed attack.
CrowdSec first observed exploitation of CVE-2026-48282 on its network, five days after deploying its detection rule.
CrowdSec deployed a detection rule to identify exploitation attempts against the ColdFusion RDS path traversal vulnerability.
Adobe disclosed and patched CVE-2026-48282 and the related arbitrary-file-read flaw CVE-2026-48313 in security bulletin APSB26-68. The fixes were included in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21.
Sina Kheirkhah of watchTowr Labs published technical analysis mapping the RDS file-write and file-read primitives to CVE-2026-48282 and CVE-2026-48313.
CrowdSec reported observing exploitation of the related ColdFusion arbitrary-file-read vulnerability CVE-2026-48313. The flaw abuses the same RDS ACTION=FILEIO interface and can expose files accessible to the ColdFusion service.
Following the Early Exploitation phase, CrowdSec classified the activity as Limited Exploitation. It attributed the plateau to the smaller population of exposed servers with RDS enabled and RDS authentication disabled.
Citrix released NetScaler Web App Firewall signatures version 183 to help mitigate several vulnerabilities, including CVE-2026-48282. Its excerpt described the ColdFusion flaw as an arbitrary file upload issue, differing from the path traversal description in other reports.
CISA added the ColdFusion path traversal vulnerability to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
BleepingComputer and DarkWebInformer reported active exploitation of the maximum-severity ColdFusion vulnerability. BleepingComputer cited a warning from the Canadian Centre for Cyber Security.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
crowdsec.net
Open sourceprevidian.com
Open sourcelabs.watchtowr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe ColdFusion is facing active exploitation of **CVE-2026-48282**, a maximum-severity flaw tied to **RDS arbitrary file write** that can be abused without privileges on unpatched servers. The Canadian Centre for Cyber Security warned that open-source reporting indicates in-the-wild attacks, while Adobe has issued security updates and urged administrators to patch immediately because of the high risk of compromise. Affected releases include **ColdFusion 2025.9, 2023.20, and earlier**, and internet scanning data from Shadowserver shows nearly **800** ColdFusion instances exposed online, though the number still vulnerable is unclear. Separate reporting on **CVE-2026-48276** highlights a closely related ColdFusion attack path in which an unauthenticated attacker uploads a malicious **CFML** payload through an unrestricted file-upload weakness, writes a web shell into a web-accessible location, and then triggers it with an HTTP request to gain code execution. That issue was described as critical with a **CVSS v3.1** score reflecting full impact to confidentiality, integrity, and availability, and its documented root causes included poor filename and extension validation and storing uploads under the web root. Public detection content has also appeared for **CVE-2026-48282**, underscoring defender focus on identifying exposed and unpatched ColdFusion systems.
Jul 12, 2026
Adobe issued urgent ColdFusion updates after multiple severe vulnerabilities were disclosed across ColdFusion 2025 and 2023, including several flaws that can lead to arbitrary code execution. The most serious newly listed issue, **CVE-2026-48362**, is an unauthenticated OS command injection bug rated `CVSS 10.0`, while **CVE-2026-48273** was rated `9.9` for eval injection. Additional high-severity flaws include **CVE-2026-71387** (incorrect authorization, `CVSS 8.8`) and **CVE-2026-71386** (cross-site scripting, `CVSS 8.8`), alongside other issues affecting authorization, memory safety, denial of service, and sensitive memory exposure. Adobe said affected versions include ColdFusion 2025 up to `2025.0.11` and ColdFusion 2023 up to `2023.0.22`, and directed customers to upgrade to **2025.0.12** or **2023.0.23**. The warnings follow earlier reports that attackers rapidly exploited at least one maximum-severity ColdFusion flaw, **CVE-2026-48282**, a path traversal vulnerability that can enable arbitrary code execution without user interaction. Researchers said exploitation began within hours of public disclosure, and Shadowserver data cited **775** internet-exposed ColdFusion instances, highlighting the reachable attack surface. Adobe said it had not observed active exploitation of the latest August issues, but advised administrators to patch immediately, restrict access to the administrative network zone and portal, limit network exposure, monitor logs for unauthorized access attempts, and accelerate remediation as ColdFusion remains a high-value target.
Aug 12, 2026
Attackers exploited Adobe ColdFusion vulnerabilities that can allow arbitrary code execution without user interaction. Adobe confirmed limited exploitation of **CVE-2023-26360** in March 2023, and FortiGuard Labs subsequently reported blocking several hundred attempts targeting the flaw. FortiGuard identified both CVE-2023-26360 and CVE-2023-26359 as deserialization vulnerabilities and reported that CISA added both to its Known Exploited Vulnerabilities catalog. A separate SecureLayer7 analysis reported CVE-2023-26360 exploitation against U.S. Federal Civilian Executive Branch agencies and, citing Threatrecon, attributed exploitation to the Chinese government-sponsored group SectorB01. CVE-2023-26360 affects **ColdFusion 2018 and 2021**, enabling unauthenticated attackers to read arbitrary files and execute code. SecureLayer7 traced the issue to unsafe handling of attacker-controlled JSON metadata, allowing arbitrary file paths to reach ColdFusion’s template-loading and compilation mechanisms. Its demonstrated execution chain placed a ColdFusion execution tag in a log file, then caused the server to process that file. Patch analysis identified a new `allowNonCFCDeserialization` control intended to restrict the unsafe behavior. Organizations should prioritize Adobe’s security updates and investigate signs of compromise on exposed servers; FortiGuard reported that IPS protection for CVE-2023-26359 remained under investigation at the time of its alert.
Oct 9, 2026