NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksUpdated

Adobe ColdFusion path traversal CVE-2026-48282 exploited; fixes available

Attackers are exploiting CVE-2026-48282 in Adobe ColdFusion website servers. Businesses should install the latest cumulative update: the first fixes were 2025 Update 10 and 2023 Update 21.

What to do

Nothing needs updating on ordinary family devices: ColdFusion is website server software. If your business uses it, ask its IT team or hosting provider to install the latest cumulative update, at least ColdFusion 2025 Update 10 or 2023 Update 21, restart it and check for signs of intrusion.

What’s happening

CVE-2026-48282 affects Adobe ColdFusion, software used to run websites and business applications. A failure to restrict file paths lets a remote attacker access files outside their intended directory and potentially run code without signing in or requiring anyone to click anything. Adobe identifies ColdFusion 2025 Update 9 and earlier, and 2023 Update 20 and earlier, on all platforms as affected. Fixes for both releases arrived on 30 June. CISA listed the flaw on 7 July, and Adobe subsequently confirmed limited attacks. CIRCL reports Shadowserver honeypot observations as recently as 1 November; those indicate attempts, not confirmed victim breaches. As at 3 November, fixes are available for both affected supported releases. The reviewed sources do not establish victim numbers or ransomware involvement.

What
Flaw
Affects
Adobe ColdFusion 2025 and 2023
Affected
ColdFusion 2025 Update 9 and earlier — all platforms
ColdFusion 2023 Update 20 and earlier — all platforms
Fixed in
ColdFusion 2025 Update 10
ColdFusion 2023 Update 21
CVE
CVE-2026-48282
Since
7 July 2026

Timeline

  1. Update

    CIRCL's record reports two Shadowserver honeypot connections associated with attempted exploitation on this date. These observations do not establish successful compromises of real organisations.

  2. Vendor revised

    By this revision, Adobe's bulletin acknowledged limited attacks exploiting CVE-2026-48282. The fixed versions remained unchanged.

  3. CISA added

    CISA added the flaw to its Known Exploited Vulnerabilities catalogue. Its entry set a 10 July remediation deadline for US federal civilian agencies.

  4. Wider attacks

    According to BleepingComputer's subsequent report, KEVIntel founder Ryan Dewhurst warned that exploitation had begun within two hours of Adobe's disclosure.

  5. New fixFixed

    Adobe disclosed CVE-2026-48282 and released fixes in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, covering both affected releases.

Sources

  1. Security update available for Adobe ColdFusion | APSB26-68Adobe · 13 July 2026
  2. ColdFusion (2025 release) Update 10Adobe · 30 June 2026
  3. ColdFusion (2023 release) Update 21Adobe · 30 June 2026
  4. CISA orders feds to patch max severity ColdFusion flaw by FridayBleepingComputer · 8 July 2026
  5. CVE-2026-48282: Mitigating a Critical Vulnerability in Adobe ColdFusionAkamai · 8 July 2026
  6. CVE-2026-48282 — Vulnerability-Lookup, including CISA and Shadowserver recordsCIRCL · 3 Nov 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS