CISA Orders Federal Agencies to Patch Actively Exploited ColdFusion Flaw
Summary
CISA ordered U.S. federal agencies to patch actively exploited Adobe ColdFusion flaw CVE-2026-48282 by June 10. The flaw enables remote code execution; Adobe has released fixes, and Shadowserver tracks nearly 800 exposed instances.
Key points
- CISA added CVE-2026-48282 to its actively exploited vulnerabilities list and ordered FCEB agencies to patch by June 10.
- The flaw affects Adobe ColdFusion 2025.9, 2023.20, and earlier versions; remote attackers can reportedly gain code execution without privileges.
- Adobe released a fix and urged administrators to install it as soon as possible.
- KEVIntel founder Ryan Dewhurst said exploitation began within two hours of Adobe’s disclosure.
- Shadowserver tracks nearly 800 internet-exposed ColdFusion instances; the article says it is unknown how many are honeypots or secured.
- Adobe also patched six other maximum-severity ColdFusion and Campaign Classic flaws, but said it was not aware of in-the-wild exploits for those issues.
Article Details
- Vulnerability Types
- Remote code execution (RCE)
- Severity
- Maximum severity
- Affected Versions
- Adobe ColdFusion 2025.9
- Adobe ColdFusion 2023.20
- Earlier Adobe ColdFusion versions
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available