{"id":"adobe-coldfusion-path-traversal-jul-2026","category":"patch","status":"live","title":"Adobe ColdFusion path traversal CVE-2026-48282 exploited; fixes available","tldr":"Attackers are exploiting CVE-2026-48282 in Adobe ColdFusion website servers. Businesses should install the latest cumulative update: the first fixes were 2025 Update 10 and 2023 Update 21.","summary":"CVE-2026-48282 affects Adobe ColdFusion, software used to run websites and business applications. A failure to restrict file paths lets a remote attacker access files outside their intended directory and potentially run code without signing in or requiring anyone to click anything. Adobe identifies ColdFusion 2025 Update 9 and earlier, and 2023 Update 20 and earlier, on all platforms as affected. Fixes for both releases arrived on 30 June. CISA listed the flaw on 7 July, and Adobe subsequently confirmed limited attacks. CIRCL reports Shadowserver honeypot observations as recently as 1 November; those indicate attempts, not confirmed victim breaches. As at 3 November, fixes are available for both affected supported releases. The reviewed sources do not establish victim numbers or ransomware involvement.","action":"Nothing needs updating on ordinary family devices: ColdFusion is website server software. If your business uses it, ask its IT team or hosting provider to install the latest cumulative update, at least ColdFusion 2025 Update 10 or 2023 Update 21, restart it and check for signs of intrusion.","product":"Adobe ColdFusion 2025 and 2023","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-48282"],"tags":["adobe","coldfusion","path-traversal","remote-code-execution","actively-exploited"],"affected":["ColdFusion 2025 Update 9 and earlier — all platforms","ColdFusion 2023 Update 20 and earlier — all platforms"],"fixed":["ColdFusion 2025 Update 10","ColdFusion 2023 Update 21"],"matches":[],"sources":[{"kind":"advisory","title":"Security update available for Adobe ColdFusion | APSB26-68","url":"https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html","by":"Adobe","date":"2026-07-13"},{"kind":"advisory","title":"ColdFusion (2025 release) Update 10","url":"https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-2025-release-update-10.html","by":"Adobe","date":"2026-06-30"},{"kind":"advisory","title":"ColdFusion (2023 release) Update 21","url":"https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-2023-release-update-21.html","by":"Adobe","date":"2026-06-30"},{"kind":"news","title":"CISA orders feds to patch max severity ColdFusion flaw by Friday","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-max-severity-coldfusion-flaw-by-friday/","by":"BleepingComputer","date":"2026-07-08"},{"kind":"research","title":"CVE-2026-48282: Mitigating a Critical Vulnerability in Adobe ColdFusion","url":"https://www.akamai.com/blog/security-research/2026/jul/adobe-coldfusion-critical-path-traversal-cve-2026-48282","by":"Akamai","date":"2026-07-08"},{"kind":"advisory","title":"CVE-2026-48282 — Vulnerability-Lookup, including CISA and Shadowserver records","url":"https://vulnerability.circl.lu/vuln/cve-2026-48282","by":"CIRCL","date":"2026-11-03"}],"started":"2026-07-07","closed":null,"created":"2026-11-03T22:16:55.337Z","updated":"2026-11-03T22:16:55.337Z","cve_notes":[{"cve":"CVE-2026-48282","name":"Path traversal in Adobe ColdFusion","what":"ColdFusion fails to keep file paths inside their permitted directory, allowing an unauthenticated remote attacker to run code with the permissions of the account running the software.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-11-01","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"CIRCL's record reports two Shadowserver honeypot connections associated with attempted exploitation on this date. These observations do not establish successful compromises of real organisations.","url":"https://vulnerability.circl.lu/vuln/cve-2026-48282","by":"CIRCL, reproducing Shadowserver observations","patch":null},{"at":"2026-07-13","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"By this revision, Adobe's bulletin acknowledged limited attacks exploiting CVE-2026-48282. The fixed versions remained unchanged.","url":"https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html","by":"Adobe","patch":null},{"at":"2026-07-07","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue. Its entry set a 10 July remediation deadline for US federal civilian agencies.","url":"https://vulnerability.circl.lu/vuln/cve-2026-48282","by":"CIRCL, reproducing CISA's catalogue","patch":null},{"at":"2026-07-02","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"According to BleepingComputer's subsequent report, KEVIntel founder Ryan Dewhurst warned that exploitation had begun within two hours of Adobe's disclosure.","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-max-severity-coldfusion-flaw-by-friday/","by":"BleepingComputer","patch":null},{"at":"2026-06-30","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Adobe disclosed CVE-2026-48282 and released fixes in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, covering both affected releases.","url":"https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html","by":"Adobe","patch":"patched"}],"url":"https://hard.fyi/live/adobe-coldfusion-path-traversal-jul-2026/","json":"https://hard.fyi/api/live?id=adobe-coldfusion-path-traversal-jul-2026"}