CVE-2026-48282: Adobe ColdFusion Unauthenticated RCE Weaponized Within 2 Hours, CVSS 10.0

Adobe ColdFusion RDS FILEIO handler contains path traversal CVE-2026-48282. Weaponized within 2 hours of disclosure. Unauthenticated arbitrary file write yields RCE. CISA added it to the KEV catalog.

On 30 June 2026 Adobe published security bulletin APSB26-68, patching 11 CVEs in ColdFusion. Seven scored CVSS 10.0. CVE-2026-48282 was exploited in the wild within 2 hours of public disclosure — the fastest weaponization tracked in 2026. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog and mandated a federal remediation deadline.

Incident Overview

CVE-2026-48282 is a path traversal (CWE-22) in the Adobe ColdFusion Remote Development Services (RDS) FILEIO handler. RDS lets developer IDEs interact with a running ColdFusion server over HTTP: browse the filesystem, execute database queries, and assist debugging.

Root cause: the FILEIO handler accepts a user-controlled file path and forwards it to the underlying filesystem API with no path canonicalization, input validation, or directory-boundary checks. An attacker can submit directory-traversal sequences (e.g. `../`) or unauthorized absolute paths and write files anywhere on the filesystem — including the web root.

Technical Details

Vulnerability mechanics

Per watchTowr Labs technical analysis, the RDS FILEIO endpoint receives file-path parameters via RPC. When RDS authentication is disabled (or misconfigured), an unauthenticated remote attacker can:

• Read arbitrary files on the server via path traversal (e.g. password config files)
• Write malicious CFM/JSP files into web-accessible directories
• Execute arbitrary code by accessing the uploaded web shell over HTTP

The full chain is a single HTTP request. No authentication. No user interaction.

Scope

• Affected versions: ColdFusion 2023 Update 20 and earlier, ColdFusion 2025 Update 9 and earlier
• Fixed versions: ColdFusion 2023 Update 21, ColdFusion 2025 Update 10
• Exploit prerequisites: RDS enabled and RDS authentication disabled (not the default, but common in legacy configs)

CVSS

| Version | Score | Severity | Vector | | --- | --- | --- | --- | | CVSS 3.1 | 10.0 | Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |

Note `S:C` (Changed Scope): exploitation can affect resources beyond the vulnerable component. Attackers can move laterally to connected systems.

Impact Assessment

Record weaponization speed

Threat intelligence platform KEVIntel observed in-the-wild exploit attempts ~2 hours after public disclosure. Fastest 2026 weaponization timeline tracked by DIESEC. Shadowserver Foundation currently tracks ~750 internet-facing ColdFusion servers.

Real-world impact

Successful exploitation lets an attacker:

• Read sensitive config files (password.properties, etc.)
• Write a web shell and take control of the server
• Steal application and database credentials
• Establish persistent backdoors and move laterally

Remediation

Patch immediately

Upgrade to:

• ColdFusion 2023 Update 21
• ColdFusion 2025 Update 10

Temporary mitigations

• Audit and disable RDS (typically unnecessary in production)
• Block network access to RDS endpoints at the firewall
• Restrict external access to admin interfaces such as /CFIDE/administrator

Post-incident detection

• Check the web root and /CFIDE/ for unauthorized .cfm/.jsp files
• Review ColdFusion access logs for anomalous requests to RDS endpoints
• Rotate all potentially exposed credentials

References

• Adobe Security Bulletin APSB26-68
• CISA KEV Catalog
• DIESEC: CVE-2026-48282 Analysis
• Resecurity: Technical Analysis