Cloud Security

ColdFusion CVE-2026-48282: Max-Severity RCE Now Under Attack

July 8, 2026 · 7 min read · By CloudAI Security

Adobe ColdFusion servers are under active attack through CVE-2026-48282, a maximum-severity (CVSS 10.0) unauthenticated remote code execution flaw in the platform’s Remote Development Services component. CISA added the bug to its Known Exploited Vulnerabilities catalog on July 7, 2026, after attackers began exploiting it within roughly two hours of public technical details emerging, just days after Adobe shipped a patch on July 1.

The Flaw and Its 10.0 Score

CVE-2026-48282 is a path traversal vulnerability inside Adobe ColdFusion’s Remote Development Services (RDS) component, specifically the FILEIO handler exposed through the /CFIDE/main/idecfm endpoint. RDS exists so a developer’s IDE can talk to a running ColdFusion server over HTTP, browsing the filesystem and running database queries. That developer convenience becomes a wide attack surface the moment an outsider can reach it without authentication.

The vulnerability lets an unauthenticated attacker read and write arbitrary files to the underlying server filesystem by sending a single specially crafted HTTP request. Adobe rates the flaw “low complexity,” meaning no special conditions need to line up for an attacker who hits a vulnerable instance. From arbitrary file write, the chain escalates predictably: upload a malicious file to a web-accessible location, request it through the web server, and execute arbitrary code in the context of the running user. That execution context is why the bug earns the maximum CVSS 10.0 score despite starting life as a file-read-and-write primitive, as SQ Magazine’s analysis and Resecurity’s technical breakdown document.

From Patch to Active Exploitation

The operational timeline is the part that should unsettle any security lead still running an unpatched ColdFusion host. Adobe shipped the fix on July 1, 2026, as part of a broader ColdFusion security update, releasing ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10. At release, Adobe said it was unaware of any in-the-wild exploitation but assigned its Priority 1 designation, the company’s highest urgency rating, and explicitly recommended deployment within 72 hours.

That runway evaporated fast. By July 3, the Canadian Centre for Cyber Security issued advisory AV26-647 citing open-source reporting of active exploitation. Then on July 6, when watchTowr Labs published a technical write-up, vulnerability intelligence firm KEVIntel captured the first in-the-wild exploitation attempt inside its global honeypot network within under two hours of the technical details going public, according to Daily Security Review. KEVIntel founder Ryan Dewhurst reported the attacker, traced to IP 103.207.14[.]220 (India), used the documented path traversal payload to read C:\Windows\win.ini — a textbook reconnaissance step that confirms the traversal works before pushing a payload.

By July 7, CISA had added CVE-2026-48282 to its Known Exploited Vulnerabilities catalog, formally confirming active exploitation. The full arc — patch to confirmed abuse — compressed into under a week, with the disclosure-to-exploitation interval measured in minutes once a PoC landed.

How the Attack Chain Works

The kill chain follows a now-familiar pattern for unauthenticated file-write RCE, and defenders should be able to model it directly:

Reconnaissance — The attacker scans for internet-facing ColdFusion instances and probes for the /CFIDE/main/idecfm RDS endpoint.
Path traversal — A crafted HTTP request exploits the FILEIO handler to read sensitive files (for example, win.ini, application configuration, or stored secrets) and to write an attacker-controlled file to a web-accessible directory.
Execution — The attacker requests the uploaded file through the web server, triggering arbitrary code execution in the context of the ColdFusion service account.
Persistence and lateral movement — A web shell is dropped, credentials and secrets accessible from the host are harvested, and the attacker pivots into backend databases, internal APIs, and adjacent systems. ColdFusion servers commonly hold access to document stores and internal services a generic web server would not, which magnifies blast radius.

The Centre for Cybersecurity Belgium laid out the same escalation path, noting that execution occurs in the context of the current user and can then be escalated to further compromise of the host. The full technique, including the specific endpoint and traversal payload, is documented in Vulmon’s CVE-2026-48282 record and corroborated by Resecurity’s tracking.

Who Is Actually Exposed

Not every ColdFusion server is a sitting target, and reading the raw exposure numbers without the precondition would overstate the risk. The attack only works where RDS is enabled and RDS authentication is disabled, a configuration that is not the default, per Resecurity’s analysis. That is a checkable state, and it should be the first thing an asset owner confirms.

The Shadowserver Foundation is tracking roughly 750 to 800 internet-facing ColdFusion instances, though it is unclear how many run a vulnerable version or meet the RDS-enabled-and-unauthenticated condition. The public count also understates real exposure: many ColdFusion deployments sit on internal networks or behind reverse proxies that Shadowserver cannot enumerate, and those become reachable the moment an attacker establishes an initial foothold elsewhere, as the RedEye/Etairos write-up on DEV Community points out.

Item	Detail
CVE	CVE-2026-48282
CVSS	10.0 (Critical, max severity)
Type	Unauthenticated path traversal / arbitrary file write and read
Component	Remote Development Services (RDS), FILEIO handler, `/CFIDE/main/idecfm`
Affected	ColdFusion 2025 (2025.9 and earlier); ColdFusion 2023 (2023.20 and earlier); older unsupported branches
Fixed in	ColdFusion 2025 Update 10; ColdFusion 2023 Update 21 (July 1, 2026)
KEV added	July 7, 2026 (CISA)
First in-wild exploitation	Within ~2 hours of technical detail release (KEVIntel honeypots)
Precondition	RDS enabled and RDS authentication disabled (not default)
Internet-facing instances	~750-800 (Shadowserver)

Detection and Threat Hunting

Because exploitation began before most teams finished reading the advisory, patching alone does not close the incident for any host that was internet-facing during the exposure window. Assume breach and hunt. The indicators are specific and cheap to look for:

Unexpected HTTP requests to /CFIDE/main/idecfm and other RDS endpoints in web server and reverse proxy logs.
Reads of classic recon files (win.ini, /etc/passwd, application configuration) originating from the RDS handler.
New or modified .cfm and .jsp files in web roots that do not match a known deployment.
Unexpected outbound connections from the ColdFusion service account, indicating a dropped web shell calling home.
Source IP 103.207.14[.]220 and adjacent infrastructure observed in the first KEVIntel captures.

ColdFusion’s history as a soft target makes this triage non-optional. The platform frequently runs on externally reachable application servers, often lags on patches, and has repeatedly cycled through Adobe’s Known Exploited Vulnerabilities catalog. Any max-severity, unauthenticated RCE landing on it is close to a worst-case configuration — the same class of fast patch-to-exploit gap we tracked in SharePoint CVE-2026-45659 when CISA set its deadline.

Action Plan for SecOps Teams

Treat this as an emergency change, not a routine patch cycle. The sequence for any organization running ColdFusion:

Inventory everything, including forgotten internal and staging servers, not just the instances you think are exposed. The internal fleet is the lateral target.
Apply the July 1, 2026 updates immediately, prioritizing internet-facing hosts. Upgrade past ColdFusion 2025.9 and 2023.20.
If you cannot patch at once, pull the server off the public internet or place it behind strict access controls until you can. Disable RDS where it is not required.
Hunt for compromise using the indicators above before declaring an instance clean.
Rotate credentials and secrets stored on or reachable from any ColdFusion host that was exposed before patching — API keys, database passwords, cloud credentials.
Verify the patch took and that RDS is either disabled or properly authenticated on every host.

The Bottom Line

CVE-2026-48282 checks every box that turns a vulnerability into a mass-exploitation event: maximum severity, unauthenticated, low complexity, a widely deployed legacy target in government, financial, and healthcare environments, and confirmed attacks within days of disclosure. Adobe’s 72-hour guidance is the tell — it is reserved for flaws under active attack. Any organization that did not apply the July 1 update within that window has been operating against confirmed in-the-wild exploitation since. Patch every ColdFusion server you own, verify it, and go looking for whoever beat you to it.