CVE-2026-48282 — actively exploited vulnerability (Adobe APSB26-68, CISA KEV)critical
Adobe ColdFusion, CVSS 10.0: code executed without a login
CVE-2026-48282 is an Adobe ColdFusion vulnerability with a CVSS score of 10.0, the maximum. A path traversal flaw in the RDS FILEIO handler lets an unauthenticated attacker read and write files on the server and, by writing a .cfm file into a web-reachable folder, execute code remotely. Adobe fixed it on 30 June 2026 with advisory APSB26-68; CISA added it to the catalog of actively exploited vulnerabilities on 7 July, with a remediation deadline of 10 July for federal agencies. Only a few days passed between patch and real-world exploitation.
Ten out of ten is not a figure of speech
On the CVSS scale, 10.0 is the ceiling. It is reached by a vulnerability that is at once trivial to exploit, requires no authentication, and leads to full control of the system. CVE-2026-48282, in Adobe ColdFusion, is all three. Adobe fixed it on 30 June 2026 with advisory APSB26-68; on 7 July CISA added it to the catalog of actively exploited vulnerabilities, setting 10 July as the remediation deadline for federal agencies under directive BOD 26-04. When a CVE goes from publication to real-world exploitation within a week, that window is your window — no more.
Where the flaw lives
The problem lives in a specific component: the FILEIO handler of ColdFusion's Remote Development Services (RDS), exposed through a web endpoint. It is a path traversal flaw — a failure to sanitise the file path. In practice, by sending a carefully crafted HTTP request to the vulnerable endpoint, an attacker can inject directory-traversal sequences (the classic ../) and step outside the intended directory.
From there the chain is short. First, arbitrary file read and write: reading sensitive files outside the permitted path, or overwriting configuration files. Then the leap: by writing a malicious .cfm file into a web-reachable folder, the attacker gets the server to execute their code, with the privileges of the ColdFusion service account. All without ever authenticating. According to Akamai's analysis, the affected endpoint is reachable via a web interface and requires no user interaction: it is, in their words, highly accessible.
- 01Crafted HTTP requestto the RDS FILEIO endpoint, no login
- 02Path traversal
../read and write files outside the intended folder - 03.cfm in the web rootremote code execution on the server
Who is exposed, and what to do now
The vulnerability is present in Adobe ColdFusion 2025.9 and earlier, and in ColdFusion 2023.20 and earlier. Adobe released the fixes in ColdFusion 2025 update 10 and 2023 update 21. The operational priority is exactly that, and it is stark: apply the APSB26-68 patches now, prioritising any instance reachable from the internet.
Those who cannot update immediately have some bridging mitigations, but none replaces the patch. Reducing exposure of the Remote Development Services — which in production rarely need to be externally reachable — takes the endpoint away from the attacker entirely. Web application firewall rules can catch known exploitation patterns, and some vendors have already published them; but a WAF filters what it knows, and on its own it does not close the hole. Akamai itself, which deployed a dedicated rule for its customers, is clear: the most effective defence remains applying the vendor's patch promptly.
A note on method, and it is owed. We describe the mechanics conceptually — path traversal, file write, code execution — and we do not publish the request or the full endpoint used to exploit the flaw: the logic of this dossier is to help people defend, not to hand out a recipe. The facts that matter are verifiable at the sources at the top of the page: Adobe's advisory for the technical description and versions, the CISA catalog for confirmation of active exploitation and the remediation deadline. ColdFusion has long been an attractive target precisely because it runs exposed web applications; a 10-out-of-10, unauthenticated flaw is exactly the kind of gift attackers wait for.
