Adobe ColdFusion CVE-2026-48282 Reportedly Exploited Within Two Hours of Disclosure
Summary
KEVIntel reported detecting ColdFusion CVE-2026-48282 exploitation within two hours of disclosure; Canada’s cyber centre also warned of exploitation based on open-source reporting. Adobe patched the critical flaw but had not updated its advisory.
Key points
- CVE-2026-48282 is a path-traversal flaw that could enable arbitrary code execution and carries a CVSS score of 10/10.
- KEVIntel said its honeypot network detected exploitation within two hours of public disclosure.
- Canada’s cyber centre also warned that the vulnerability had been exploited, citing open-source reporting.
- Adobe released ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21 on June 30 to address the flaw and five other maximum-severity vulnerabilities.
- Adobe’s advisory initially said it was unaware of in-the-wild exploitation; the company had not updated it to reflect the later reports.
Article Details
- Vulnerability Types
- Path traversal
- Arbitrary code execution
- Severity
- Critical (CVSS 10/10)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available