Adobe ColdFusion flaw CVE-2026-48282 now exploited in the wild

Attackers are exploiting the critical Adobe ColdFusion flaw CVE-2026-48282, which allows remote code execution on unpatched servers.

Attackers have started exploiting CVE-2026-48282, a maximum-severity vulnerability in Adobe ColdFusion. The flaw is a path traversal issue that could result in arbitrary code execution without authentication. It affects ColdFusion 2025.9, 2023.20, and earlier versions, allowing remote attackers to execute code on vulnerable servers.

The company warned that the vulnerability is easy to exploit and is likely to be exploited in attacks in the wild.

KEVIntel researchers reported that Less than two hours after details of CVE-2026-48282 became public, attackers started exploiting it in attacks in the wild.

KEVIntel founder Ryan Dewhurst reported that the attacks originated from the IP address 103.207.14[.]220 by an attacker located in India.

🚨Within under two hours of CVE-2026-48282 public details being released, KEVIntel captured in-the-wild exploitation within our global honeypot network.

Unauthenticated Arbitrary File Write & Read in Adobe ColdFusion

Attacker location: India
Attacker IP: 103.207.14[.]220

If… pic.twitter.com/fok7ZQ56Gy

— Ryan Dewhurst (@ethicalhack3r) July 2, 2026

Organizations running Adobe ColdFusion should install the latest security updates as soon as possible to protect their systems from ongoing attacks.

In February 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added  another Adobe ColdFusion Deserialization Vulnerability, tracked as CVE-2017-3066, to its Known Exploited Vulnerabilities (KEV) catalog.

Early this year, GreyNoise reported a coordinated campaign exploiting about a dozen Adobe ColdFusion vulnerabilities, with thousands of attack attempts observed during the Christmas 2025 holiday.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-48282)