CISA Flags Actively Exploited Adobe ColdFusion RCE (CVE-2026-48282, CVSS 10.0)

On July 7, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a maximum-severity Adobe ColdFusion vulnerability to its 悪用が確認された脆弱性（KEV）カタログ, warning that it is being exploited in the wild. Tracked as CVE-2026-48282 and rated CVSS 10.0, the flaw lets an unauthenticated attacker achieve remote code execution — and federal agencies were given only until July 10 to patch under Binding Operational Directive 26-04.

Path traversal in the RDS handler, leading to unauthenticated RCE

CVE-2026-48282 is an improper path-limitation flaw (CWE-22) in ColdFusion’s Remote Development Services (RDS) FILEIO handler. Because the handler fails to properly validate paths, an unauthenticated attacker can write arbitrary files anywhere on the server’s file system — including the web root. Dropping a malicious file into a web-accessible directory turns that file-write into full, unauthenticated remote code execution. No login and no user interaction are required, which is exactly why it earns a perfect 10.0.

Patched June 30, exploited by July 7

Adobe shipped fixes on June 30, 2026 for the ColdFusion 2023 and 2025 release lines. One week later, CISA confirmed active exploitation and added the CVE to KEV with a three-day remediation deadline. That compressed timeline is a signal in itself — CISA reserves the tightest windows for bugs being weaponized right now. ColdFusion also has a long history of being targeted: its RCE flaws are a recurring favorite of ransomware operators and initial-access brokers.

今すぐ取るべき対応

If you run Adobe ColdFusion 2023 or 2025, apply the June 30 security updates immediately. Beyond patching, Remote Development Services should never be exposed to the internet: disable RDS in production if it is not needed, and restrict access to ColdFusion administration interfaces. Because exploitation is unauthenticated and leads directly to code execution, treat any internet-facing ColdFusion server that stayed unpatched after June 30 as potentially compromised, and hunt for unexpected files in web-accessible directories.