CVE-2026-48282
Adobe ColdFusion Path Traversal Vulnerability
Description
CVE-2026-48282 is a maximum-severity path traversal vulnerability in Adobe ColdFusion that can lead to arbitrary code execution without any user interaction. The flaw stems from improper limitation of a pathname to a restricted directory, allowing an attacker to manipulate file path references and escape the intended directory, ultimately executing code in the context of the current user. It affects ColdFusion 2025.9, 2023.20, and earlier, and carries the highest possible CVSS score of 10.0 (Critical) with a Changed scope. CISA has added CVE-2026-48282 to its Known Exploited Vulnerabilities (KEV) catalog and its EPSS score sits in the 98th percentile, so organizations running affected ColdFusion versions should treat this path traversal vulnerability as an emergency and patch without delay.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | 2023; 2025 |
References
- https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
This weakness occurs when ColdFusion uses external input to build a file path but fails to neutralize special elements such as "../", letting the path resolve to a location outside the restricted parent directory. In ColdFusion this path traversal enables an attacker to reach files beyond the intended directory and, in this case, drive arbitrary code execution in the context of the current user.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2026-48282 reaches the maximum CVSS 3.1 score of 10.0 (Critical) because no barrier to exploitation exists and the impact crosses a security boundary. The vulnerability is remotely exploitable over the network without physical access, it is easy to exploit with no special conditions needed (Attack Complexity Low), it requires no authentication (Privileges Required None), and it requires no user action (User Interaction None). The scope is Changed, meaning exploitation can affect resources beyond the vulnerable ColdFusion component, and the High confidentiality, integrity, and availability impacts mean an attacker can read sensitive files, alter data or code, and disrupt the server through arbitrary code execution. Because CISA lists this vulnerability in its KEV catalog and its EPSS score is in the 98th percentile, active exploitation is confirmed and highly likely to continue.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-48282 in the wild by adding it to the Known Exploited Vulnerabilities catalog, so this is a live threat requiring immediate action. The EPSS score of roughly 28.6% (98th percentile) indicates a very high likelihood of ongoing exploitation activity — among the highest tiers observed — which aligns with the KEV listing. Ransomware use is currently listed as Unknown, and the primary public source is Adobe's vendor advisory APSB26-68, which documents the affected versions and fixes. Given the maximum CVSS 10.0 rating, confirmed exploitation, and top-percentile EPSS, ColdFusion operators must patch as an emergency.
Remediation
- Follow CISA's KEV required action: apply mitigations in accordance with Adobe's instructions, ensure compliance with CISA's BOD 26-04 patching guidance, and discontinue use of the product if mitigations are unavailable. The remediation due date was 2026-07-10.
- Apply the fixes described in Adobe's security bulletin APSB26-68 and upgrade ColdFusion beyond the affected 2025.9 and 2023.20 releases, since versions 2025.9, 2023.20, and earlier are affected.
- As an interim mitigation, restrict network access to the ColdFusion server, place it behind a WAF configured to detect path traversal sequences such as "../", and limit exposure of administrative endpoints to the public internet.
- Review server and application logs for suspicious requests containing traversal sequences or references to unexpected file paths, and check for indicators of code execution or unfamiliar files on the host.
- As long-term hardening, apply strict input validation using an allowlist of permitted filenames or path components, use canonical path resolution to verify that the resulting absolute path stays within the intended directory before any file operation, and avoid passing user-controlled input directly into file system calls.
Technical Details
The root cause of CVE-2026-48282 is CWE-22, an improper limitation of a pathname to a restricted directory: ColdFusion constructs a file path from external input without properly neutralizing traversal elements like "..", so the path resolves outside the intended directory and leads to arbitrary code execution in the context of the current user. The attack is delivered over the network (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), and the Changed scope (S:C) reflects that the impact extends beyond the vulnerable component — together these produce the maximal CVSS 3.1 score of 10.0 for the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The High confidentiality, integrity, and availability impacts follow from the resulting code execution capability.
Frequently Asked Questions
Is CVE-2026-48282 being actively exploited?
Yes. CISA has added CVE-2026-48282 to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild, and its EPSS score sits in the 98th percentile, indicating a very high probability of ongoing exploitation. Ransomware association is currently listed as Unknown.
What products are affected by CVE-2026-48282?
The vulnerability affects Adobe ColdFusion versions 2025.9, 2023.20, and earlier. Organizations running these ColdFusion releases should apply Adobe's updates from bulletin APSB26-68 immediately.
How do I fix CVE-2026-48282?
Apply the fixes in Adobe's security bulletin APSB26-68 and upgrade beyond the affected 2025.9 and 2023.20 releases, following CISA's KEV guidance. In the interim, restrict network access to the ColdFusion server, deploy a WAF that detects path traversal sequences, and review logs for traversal-based requests.
How severe is CVE-2026-48282?
It is Critical and carries the maximum possible CVSS 3.1 score of 10.0, driven by unauthenticated network exploitability, a Changed scope, and High impact across confidentiality, integrity, and availability. With confirmed active exploitation in CISA's KEV catalog and an EPSS score in the 98th percentile, it is one of the most severe and urgent vulnerabilities an organization can face.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.