Loading story…
Adobe issued urgent ColdFusion updates after multiple severe vulnerabilities were disclosed across ColdFusion 2025 and 2023, including several flaws that can lead to arbitrary code execution. The most serious newly listed issue, CVE-2026-48362, is an unauthenticated OS command injection bug rated CVSS 10.0, while CVE-2026-48273 was rated 9.9 for eval injection. Additional high-severity flaws include CVE-2026-71387 (incorrect authorization, CVSS 8.8) and CVE-2026-71386 (cross-site scripting, CVSS 8.8), alongside other issues affecting authorization, memory safety, denial of service, and sensitive memory exposure. Adobe said affected versions include ColdFusion 2025 up to 2025.0.11 and ColdFusion 2023 up to 2023.0.22, and directed customers to upgrade to 2025.0.12 or 2023.0.23.
The warnings follow earlier reports that attackers rapidly exploited at least one maximum-severity ColdFusion flaw, CVE-2026-48282, a path traversal vulnerability that can enable arbitrary code execution without user interaction. Researchers said exploitation began within hours of public disclosure, and Shadowserver data cited 775 internet-exposed ColdFusion instances, highlighting the reachable attack surface. Adobe said it had not observed active exploitation of the latest August issues, but advised administrators to patch immediately, restrict access to the administrative network zone and portal, limit network exposure, monitor logs for unauthorized access attempts, and accelerate remediation as ColdFusion remains a high-value target.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Adobe modified the CVE-2026-71387 record on August 11, 2026, changing the affected product default status from unaffected to affected. The update also reflected the Adobe advisory and product ranges for ColdFusion 2025 and 2023.
On August 11, 2026, Adobe added the initial CVE record for CVE-2026-71387, an incorrect authorization vulnerability in ColdFusion. The flaw can lead to arbitrary code execution without user interaction and affects ColdFusion 2025 through 2025.0.11 and 2023 through 2023.0.22.
A new CVE entry for CVE-2026-71386 was received from Adobe's PSIRT on August 11, 2026. The record describes a high-severity ColdFusion cross-site scripting flaw that can lead to arbitrary code execution in the current user's context and affects ColdFusion 2025 through 2025.0.11 and 2023 through 2023.0.22.
Security researchers reported that CVE-2026-48282 was being targeted within hours of becoming public. The flaw affects Adobe ColdFusion and can enable arbitrary code execution via path traversal.
On June 30, Adobe released security bulletin APSB26-68 for ColdFusion, fixing 11 vulnerabilities, including six rated CVSS 10.0. The bulletin included CVE-2026-48282, a path traversal flaw that can lead to arbitrary code execution without user interaction.
Adobe said in June that it would move from monthly to twice-monthly publication of security advisories. The company linked the change to faster vulnerability discovery and a shrinking exploitation window driven by AI.
Adobe issued urgent security updates for ColdFusion 2025 and ColdFusion 2023 to fix multiple vulnerabilities, including CVE-2026-48362, CVE-2026-48273, CVE-2026-71384, CVE-2026-71386, and CVE-2026-71387. Adobe instructed administrators to upgrade to ColdFusion 2025.0.12 or 2023.0.23 and said it had not observed active exploitation in the wild.
Adobe urged ColdFusion customers to patch immediately after reports emerged that attackers were exploiting at least one maximum-severity ColdFusion vulnerability. At the time cited in the report, Adobe said it was not aware of exploits in the wild for the APSB26-68 flaws, while researchers reported targeting of CVE-2026-48282.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe ColdFusion is facing active exploitation of **CVE-2026-48282**, a maximum-severity flaw tied to **RDS arbitrary file write** that can be abused without privileges on unpatched servers. The Canadian Centre for Cyber Security warned that open-source reporting indicates in-the-wild attacks, while Adobe has issued security updates and urged administrators to patch immediately because of the high risk of compromise. Affected releases include **ColdFusion 2025.9, 2023.20, and earlier**, and internet scanning data from Shadowserver shows nearly **800** ColdFusion instances exposed online, though the number still vulnerable is unclear. Separate reporting on **CVE-2026-48276** highlights a closely related ColdFusion attack path in which an unauthenticated attacker uploads a malicious **CFML** payload through an unrestricted file-upload weakness, writes a web shell into a web-accessible location, and then triggers it with an HTTP request to gain code execution. That issue was described as critical with a **CVSS v3.1** score reflecting full impact to confidentiality, integrity, and availability, and its documented root causes included poor filename and extension validation and storing uploads under the web root. Public detection content has also appeared for **CVE-2026-48282**, underscoring defender focus on identifying exposed and unpatched ColdFusion systems.
Jul 12, 2026
Adobe disclosed two high-severity vulnerabilities in **ColdFusion** that affect versions **2023.18, 2025.6, and earlier**. The first, `CVE-2026-27304`, is an improper input validation flaw (`CWE-20`) that can lead to **arbitrary code execution** in the context of the current user without requiring user interaction. Adobe assigned the issue a CVSS v3.1 vector of `AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N` and published details in security bulletin **APSB26-38**. Adobe also disclosed `CVE-2026-27305`, a **path traversal** vulnerability (`CWE-22`) in the same ColdFusion versions that allows an unauthenticated remote attacker to perform **arbitrary file system reads** and access sensitive files outside intended directories. The flaw likewise requires no user interaction and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`, making the pair of issues a significant risk for exposed ColdFusion deployments.
Jun 30, 2026
Adobe released security updates for 12 products, fixing 88 vulnerabilities across its portfolio, with the most urgent issues affecting **ColdFusion**. The ColdFusion advisory was rated **Priority 1** and addresses 13 flaws, including eight critical vulnerabilities that could allow **arbitrary code execution** or **privilege escalation** through path traversal, code injection, improper input validation, missing authentication, SQL injection, and incorrect authorization. The fixes are included in **ColdFusion 2025 Update 11** and **ColdFusion 2023 Update 22**. Adobe also patched critical vulnerabilities in **Commerce**, **Experience Manager**, and **Illustrator**, and said it is not aware of any of the newly addressed vulnerabilities being exploited in the wild.
Jul 15, 2026