Adobe ColdFusion CVE-2026-48282: critical 0-day

Adobe fixed a series of critical bugs in ColdFusion, and one of them — CVE-2026-48282, rated the maximum CVSS 10.0 — entered active exploitation within hours of a technical write-up going public. It’s a textbook “n-day”: not a 0-day in the strict sense, because a patch already existed, but a flaw exploited en masse before administrators managed to deploy it. Below we stick to facts confirmed by the vendor and researchers — without inventing a story about attackers or scale that no one has officially disclosed.

What was patched

In late June 2026 Adobe shipped fixes removing several top-severity bugs from ColdFusion. The most dangerous, CVE-2026-48282, is a path traversal flaw in the handling of Remote Development Services (RDS) — a component historically used for remote file editing. By abusing directory traversal in the file-handling module, an unauthenticated attacker can send a crafted HTTP request and write their own file to a web-accessible location — and from there it’s a short path to remote code execution (RCE) on the server.

The key technical condition: the attack works where RDS is enabled and its authentication is disabled. In a default production configuration RDS stays disabled — good news — but in practice it gets switched on “just for a moment” during deployments and never returns to the safe state. Those are exactly the servers first in the crosshairs.

Why it’s so urgent

According to Help Net Security, the first exploitation attempts were caught by honeypots shortly after watchTowr researchers published a detailed analysis of the patched bugs on 2 July. The gap between the public analysis and real-world attacks was measured in hours, not weeks. That’s the single most important takeaway: once an attack technique becomes public, the window for calm patching disappears.

CVE-2026-48282 also wasn’t a lone problem — Adobe removed several 10.0-rated flaws in the same round, so treat the whole bulletin as a unit, not as “one urgent item and the rest.” Internet-facing application servers are among the most valuable targets, because they yield code execution close to your data and business logic — the same pattern we discussed in how to prioritise critical vulnerabilities.

Which versions are safe

The fixes landed in the following releases:

• ColdFusion 2025 — Update 10 or later;
• ColdFusion 2023 — Update 21 or later.

Older, unsupported ColdFusion branches will not receive a fix — if you run one, simply “updating the package” is not an option and you must plan a migration or take the service off the network. Verify the version on the server itself (the ColdFusion admin panel or version files), not from the date of some recent “update.”

What to do now — a plan for the next few hours

1. Inventory ColdFusion. Find where it really runs — including forgotten developer machines and legacy apps. The most dangerous instances are the ones nobody remembers.
2. Apply the patch (ColdFusion 2025 Update 10 / 2023 Update 21), starting with internet-reachable servers.
3. Disable RDS in production. If it’s not needed — and in production it usually isn’t — turn it off entirely. If it must stay, enforce authentication on it and restrict network access.
4. Reduce the attack surface. Admin interfaces and RDS should not be reachable from the whole internet. A WAF rule for virtual patching buys time but doesn’t replace the fix.
5. Check whether it’s already too late. Review web-server logs for suspicious requests to RDS endpoints and for new files (e.g. scripts) appearing in application directories. Unusual child processes of the application server are a warning sign.

That last point is critical. With a vulnerability under mass exploitation, the question isn’t only “did we patch” but “did someone get in first.” If the server was exposed during the critical window, treat it as an incident to investigate and — if there are signs of compromise — rotate secrets, because the patch alone does not remove an attacker who already stole keys. This is a standing rule of mature vulnerability management.

Frequently asked questions (FAQ)

We don’t have RDS enabled — are we safe? For CVE-2026-48282, exploitation requires RDS enabled with authentication disabled. If RDS is off, this specific path won’t work — but install the patch anyway, because Adobe removed other critical bugs in the same round, and configurations get changed without the team’s knowledge.

Is a WAF enough instead of the patch? No. A WAF rule blocking known attack patterns is valuable risk reduction while you roll out the fix, but attackers modify payloads and a virtual patch doesn’t fix the root cause. Treat it as a buffer, not a solution.

How do we check whether the server was already compromised? Look in the logs for unusual requests to RDS/management services, new script files in application directories, and unusual outbound network activity. If in doubt, preserve the data and commission a forensic analysis.

Why call it a 0-day if a patch existed? Strictly it’s an “n-day” — a flaw with an available fix, but exploited before organisations deployed it. For a defender the distinction is academic: the outcome is the same as a 0-day if you don’t patch in time.

Summary

CVE-2026-48282 doesn’t call for panic, just fast, measurable action: update ColdFusion to 2025 Update 10 / 2023 Update 21, disable RDS in production, and review logs for prior compromise. The story of this flaw is above all a lesson about speed: hours passed between the public analysis and mass exploitation. If you run internet-facing systems and want to know how fast you could respond to the next such scenario — let’s talk about testing and monitoring.

---

Sources and further reading: Help Net Security, Adobe Security Bulletins, CISA KEV, watchTowr Labs.