Adobe ColdFusion Flaw CVE-2026-48282 Actively Exploited

A critical vulnerability in Adobe's ColdFusion web application platform is being actively exploited by attackers just days after a patch was released, posing a severe risk to unpatched servers. The flaw, tracked as CVE-2026-48282, is a maximum-severity path traversal issue that allows unauthenticated remote code execution on affected systems.

Adobe released security updates to address this and several other vulnerabilities on July 1, 2026. The company's advisory recommends deploying the patch within 72 hours, a timeline typically reserved for flaws under active attack. The updates resolve the issues in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, with earlier versions also being vulnerable.

Exploitation began with alarming speed. Security researchers reported that active attacks were detected in the wild less than 48 hours after the patch was issued. Ryan Dewhurst, founder of KEVIntel, stated that exploitation was observed within two hours of technical details becoming public, which he described as an exceptionally fast turnaround. One confirmed attack attempt originated from an IP address geolocated to India.

The vulnerability is considered low-complexity, meaning...