Adobe ColdFusion CVE-2026-48282 Exploited in the Wild
Summary
CCCS says attackers are exploiting CVE-2026-48282, a maximum-severity ColdFusion flaw that can enable unauthenticated remote code execution. Adobe released patches; nearly 800 instances are exposed online, though their status is unclear.
Key points
- CCCS warned that CVE-2026-48282 is being exploited in the wild.
- The flaw can allow unauthenticated attackers to achieve remote code execution on vulnerable systems.
- Affected ColdFusion versions include 2025.9, 2023.20, and earlier.
- Adobe released emergency security updates and recommends administrators install them as soon as possible, within 72 hours as an example.
- Shadowserver tracks nearly 800 ColdFusion instances exposed online; the article says it is unclear how many are honeypots or secured against this vulnerability.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Severity
- Maximum severity
- Affected Versions
- Adobe ColdFusion 2025.9 and earlier
- Adobe ColdFusion 2023.20 and earlier
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available