CISA flags exploited Adobe ColdFusion flaw as federal patch deadline arrives

CISA has added an Adobe ColdFusion path traversal flaw to its Known Exploited Vulnerabilities catalog after Adobe updated its June security bulletin to say the bug is being used in limited attacks. The entry raises the urgency for organizations still running ColdFusion 2025 Update 9 or earlier, or ColdFusion 2023 Update 20 or earlier.

The tracked issue, CVE-2026-48282, is a critical path traversal vulnerability. Adobe's bulletin assigns it a CVSS 3.1 base score of 10.0 and says successful exploitation could lead to arbitrary code execution in the context of the current user. The National Vulnerability Database describes the same affected product branches and notes that exploitation does not require user interaction.

Why it matters

ColdFusion remains a server-side platform in many enterprise and public-sector environments, which makes an actively exploited code execution flaw more than a routine patch item. CISA's catalog entry sets a July 10, 2026 remediation deadline for covered federal systems under its newer risk-based patching directive. The agency also tells stakeholders to evaluate internet exposure and apply vendor mitigations, or discontinue affected use where mitigations are unavailable.

Adobe's available fixes are ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. The advisory also points administrators toward current Java runtime updates, serial filter documentation, security configuration guidance, and ColdFusion lockdown guides. Those extra hardening steps matter because the same bulletin covers a broader set of ColdFusion flaws, including multiple critical arbitrary code execution issues, arbitrary file system read, privilege escalation, and security feature bypass vulnerabilities.

• CVE-2026-48282 is the issue CISA lists as known exploited.
• Adobe says exploitation has been limited, but public confirmation of in-the-wild activity changes the risk calculus.
• Organizations should prioritize externally reachable ColdFusion servers, confirm update levels, and review logs for suspicious file path access or unexpected code execution behavior.

The practical takeaway is straightforward: this is no longer only a scheduled maintenance update. Any exposed ColdFusion deployment in the affected version range should be treated as a near-term incident-prevention priority, with patching and post-update review handled together.

Sources

• helpx.adobe.com
• nvd.nist.gov
• www.cisa.gov

Cover photo by panumas nikhomkhai on Pexels, used under the Pexels License.