Adobe ColdFusion CVE-2026-48282: 800 Exposed Servers Under Active Attack

CVE-2026-48282 exploits a path traversal flaw in ColdFusion's Remote Development Services FILEIO handler. RDS is a legacy ColdFusion component designed to give development tools remote access to the server file system for operations including file reads and writes. The FILEIO handler accepts file paths in its request body and passes them to the underlying OS file system API.

The root cause is the absence of path canonicalization. The unpatched FILEIO handler passes user-supplied file paths directly to the file system API without resolving traversal sequences (../ and ..), blocking absolute paths outside permitted directories, or stripping null-byte injection attempts. The patched version introduced canonical path resolution and explicit directory boundary enforcement.

An attacker exploits CVE-2026-48282 in four steps. First, probe the RDS endpoint by sending an HTTP request to /CFIDE/main/ide.cfm?ACTION=FILEIO to confirm it is accessible and unauthenticated. Second, send a crafted POST request with a path traversal payload in the request body to confirm arbitrary file write capability. Third, write a malicious CFML web shell (.cfm file) to a publicly accessible directory: the web root, /CFIDE/, or any directory under the ColdFusion document root. Fourth, access the dropped shell over HTTP to execute system commands.

The shell accepts commands via a URL parameter and returns output directly in the HTTP response. From that point, the attacker has interactive command execution with the permissions of the ColdFusion service account. In many default configurations, the ColdFusion service runs as a local administrator or domain account with broad file system access, making lateral movement and credential harvesting straightforward. The Canadian Centre for Cyber Security (CCCS) issued an independent advisory citing this same exploitation chain.

Exploitation requires RDS to be enabled on the target server. RDS is disabled by default on production ColdFusion deployments but enabled by default in development configurations. Any organization that deployed a development ColdFusion server to an internet-accessible network, or enabled RDS on a production server for remote development access, is directly exposed.

Shadowserver's internet-scanning infrastructure tracks approximately 800 publicly accessible ColdFusion instances globally. These are servers that expose ColdFusion services directly to the open internet, not internal deployments protected by firewalls or VPNs. Any of these running ColdFusion 2025 Update 9 or earlier, or ColdFusion 2023 Update 20 or earlier, with RDS accessible to external IP addresses, faces confirmed active exploitation.

ColdFusion is deployed predominantly in enterprise sectors that adopted it during its peak years in the early 2000s: government agencies, higher education institutions, healthcare organizations, financial services firms, and large e-commerce operations. Many of these deployments run on aging infrastructure where patching cycles are slow, change control processes require extended lead times, and dependency on legacy applications complicates version upgrades. Those characteristics -- slow patching, internet-exposed services, legacy dependencies -- create exactly the conditions that make CVE-2026-48282 exploitable in practice.

Adobe has disclosed multiple maximum-severity ColdFusion vulnerabilities in rapid succession in 2026. CISA previously added a ColdFusion deserialization flaw to the KEV catalog in June 2026. CVE-2026-48282 joined the catalog within hours of disclosure. The back-to-back KEV additions indicate sustained attacker interest in ColdFusion infrastructure, not a one-off event.

Among the 800 tracked exposed instances, any server with RDS accessible from the internet and running an unpatched version is exposed to confirmed exploitation activity. For context on how a similar unauthenticated RCE in Joomla (CVE-2026-48907) was exploited against publicly exposed CMS installations this same week, see our Joomla unauthenticated RCE patch advisory.

KEVIntel's global honeypot network captured the first exploitation attempt against CVE-2026-48282 within two hours of Adobe releasing APSB26-68. The attack traffic originated from 103.207.14.220, an IP address geolocated to India with no prior registered threat reputation at time of discovery. Resecurity analysis confirmed the IP was operating as a scanning probe, testing the FILEIO endpoint across known ColdFusion IP ranges identified through public internet-scanning databases including Shodan and Censys.

The exploit chain observed in KEVIntel honeypots matched the sequence described in post-publication proof-of-concept analysis: an initial FILEIO probe, a path traversal write attempt targeting the web root, and a follow-up GET request to verify whether the write succeeded. Successful web shell placement was confirmed in the honeypot environment within the first contact window.

CISA's KEV addition confirms that exploitation extends beyond honeypot detections. CISA adds vulnerabilities to the KEV catalog only when it has evidence of real-world exploitation against actual production systems, not just proof-of-concept code or honeypot data. The parallel advisory from the Canadian Centre for Cyber Security indicates intelligence sharing between agencies confirmed active exploitation targeting operational government and enterprise systems in both countries.

The speed of exploitation follows a pattern documented across multiple prior Adobe ColdFusion vulnerabilities. In 2023, Chinese state-sponsored threat actors exploited ColdFusion deserialization vulnerabilities to deploy web shells across U.S. government networks. In 2017, CVE-2017-3066 was exploited for similar web shell deployment within days of disclosure. Any organization that has not validated its ColdFusion patch status against APSB26-68 should treat the installation as potentially compromised until forensic review confirms otherwise.

The following artifacts indicate a ColdFusion server may have been compromised via CVE-2026-48282. Check all items before declaring a system clean. Web shells can persist for weeks after initial intrusion if post-compromise cleanup is not thorough.

Patching CVE-2026-48282 requires updating to the fixed ColdFusion release and confirming that RDS is either disabled or restricted to internal network access. Both steps are required; patching alone does not remediate any web shells already dropped by exploitation activity before the patch was applied.

CVE-2026-48282 is not a theoretical threat pending proof-of-concept code. Exploitation of Adobe ColdFusion CVE-2026-48282 began within two hours of disclosure and has been independently confirmed by KEVIntel honeypots, CISA's KEV catalog, and the Canadian Centre for Cyber Security.

ColdFusion's enterprise deployment profile makes the practical risk severe. Government agencies, healthcare systems, and financial institutions run ColdFusion-backed applications on production infrastructure where patching requires change control approval and scheduled maintenance windows. For organizations whose ColdFusion servers face the public internet and whose patch cycles run longer than 24 hours, the window between patch availability and exploitation has already closed. Those systems need immediate triage, not a scheduled patch cycle.

The CISA KEV deadline of July 10, 2026 applies to federal civilian executive branch agencies, but CISA routinely uses KEV designations as an industry-wide signal. When CISA sets a same-week deadline and the Canadian Centre for Cyber Security issues a parallel advisory, both agencies are communicating that confirmed exploitation is active and widespread enough to require emergency response across sectors.

The patch for CVE-2026-48282 is available now: ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. Organizations that cannot patch before the weekend closes should disable RDS to eliminate the primary attack surface, block external access to /CFIDE/, and scan the web root for unauthorized .cfm files as an immediate mitigation. For additional context on the SharePoint RCE vulnerability CISA also added to KEV this week with the same July 10 deadline, see our SharePoint RCE CVE-2026-45659 advisory.