Download the latest Vulnerability & Exploitation Report

Download now

CrowdSec

VulnTracking

Adobe ColdFusion RDS Path Traversal to RCE (CVE-2026-48282) Races From Patch to Active Exploitation

The CrowdSec Network is tracking a fast-moving wave of attacks on CVE-2026-48282, a critical flaw in Adobe ColdFusion. An unauthenticated attacker can abuse ColdFusion’s Remote Development Services (RDS) to escape the intended directory, drop a web shell, and run arbitrary code on the server. The vulnerability barely had time to be patched before it was flagged as exploited: CISA added it to its “must-fix” list within a week of disclosure, and it took just days to reach active exploitation on our network.

Key findings

  • Patched June 30, on CISA’s exploited list by July 7, exploited on our network from July 20: Adobe published CVE-2026-48282 on June 30, 2026 as part of security bulletin APSB26-68. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on July 7, only a week later, with a federal remediation deadline of July 10. CrowdSec shipped a detection rule on July 15 and saw the first in-the-wild exploitation on July 20. That is an unusually short runway from patch to attack.
  • A perfect-score RCE with a public exploit: The flaw carries the maximum CVSS 10.0 rating. A working proof-of-concept and a public Nuclei detection template are already circulating, which puts exploitation within reach of low-skill, automated attackers.
  • Raced to Early Exploitation, now holding at Limited: Once attacks started, CVE-2026-48282 jumped from “Insufficient Data” to “Early Exploitation” in only four days (July 20 to July 24), with 107 unique IP addresses probing exposed servers. Activity has since settled into our “Limited Exploitation” phase, a plateau we explain below. Getting from the first hit to Early Exploitation in four days is the part worth flagging.
  • One of a ColdFusion “CVE bonanza”: CVE-2026-48282 is the arbitrary-file-write half of a matched pair. Its sibling, CVE-2026-48313 (CVSS 9.3), is an arbitrary-file-read bug patched in the very same advisory and abusing the very same interface. We are already seeing exploitation of both.

What is Adobe ColdFusion?

Adobe ColdFusion is a long-standing platform for building and running web applications quickly, using its own scripting language (CFML). It is typically maintained by enterprise developers, IT teams, and integrators inside companies, government agencies, universities, and e-commerce shops, often powering internal portals and public-facing sites that have been running for years.

Remote Development Services (RDS) is a ColdFusion feature that lets developers browse and edit files on a ColdFusion server from their IDE. It is meant for development, not production, and it is switched off by default.

Why it matters: ColdFusion servers tend to sit at the heart of business operations and hold sensitive data, and many are older, internet-facing installations that rarely get touched. A successful attack against this flaw means arbitrary code execution as the ColdFusion service account, which is effectively full control of the application and a foothold into the network behind it: stolen customer records, planted backdoors, ransomware staging, or lateral movement. ColdFusion also has a track record of exactly this kind of file-access bug, so attackers know precisely where to look.

How does CVE-2026-48282 work?

The weakness lives in ColdFusion’s RDS FileServlet, which fails to properly canonicalize file paths before acting on them (CWE-22, path traversal). An attacker sends a POST request to the RDS endpoint /CFIDE/main/ide.cfm?ACTION=FILEIO carrying a crafted, length-prefixed payload. Because the path is not cleaned up, the request can escape the intended directory and write a file anywhere the service can reach, including a web-accessible folder.

From there, the jump to full takeover is short: the attacker writes a small CFML web shell containing <cfexecute> tags, then requests it over the web to run commands on the server. In the exploitation we observe, attackers plant a file and immediately fetch /CFIDE/<filename>.txt to confirm the write landed before escalating.

The sibling bug, CVE-2026-48313, uses the same ACTION=FILEIO interface to read files instead of writing them (for example /etc/passwd on Linux or C:\Windows\win.ini on Windows), leaking sensitive data and credentials that make the write-to-RCE path even easier. Both were traced to the same failure to canonicalize paths in the RDS servlets, which is why they were disclosed and patched together.

One caveat keeps this from being universally exploitable: it only works when RDS is enabled and RDS authentication is turned off, which is not the default. That narrows the exposed population to misconfigured servers, which shapes the attack pattern we describe below.

The technical analysis was published by Sina Kheirkhah (@SinSinology) of watchTowr Labs, who mapped the RDS FILEIO write and read primitives to this pair of CVEs.

Threat Landscape Analysis

CrowdSec has been tracking CVE-2026-48282 since our rule went live on July 15, 2026. The timeline is what stands out. A CVSS 10.0 flaw that Adobe only patched on June 30 was on CISA’s list of exploited vulnerabilities within a week, and it reached our “Early Exploitation” phase four days after the first observed hit. When a brand-new critical bug moves that fast, defenders have almost no grace period.

So far, 107 unique IP addresses have been seen attacking this flaw across our network. The attacking infrastructure is led by Ireland, the United States, South Africa, and Singapore, and the activity is a fairly even mix of indiscriminate scanning and more targeted, reconnaissance-first attempts, rather than pure spray-and-pray. The organizations getting probed skew toward e-commerce, non-profits, healthcare, and industry, with a notable concentration of targets in France, Australia, South Africa, and Germany. The dominant attacker goal we infer is infrastructure takeover, closely followed by data exfiltration, which fits a “get a shell, then grab the data” playbook.

The surprising part is what didn’t happen. Unlike a core-software flaw that hits every install by default, this one only works where RDS is left enabled and unauthenticated. That non-default requirement is why exploitation raced to Early Exploitation on interest alone and then cooled to “Limited Exploitation” as attackers exhausted the smaller pool of misconfigured, exposed servers. Limited does not mean safe: the servers that are vulnerable are trivially ownable, they are being actively hunted, and a public exploit means the barrier to entry is effectively zero.

How to protect your systems

  • Patch: Update ColdFusion now. The fixes ship in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21; anything on 2025.9 / 2023.20 or earlier is affected. While you patch, confirm RDS is disabled in production (it should be), and if you genuinely need it, enable RDS authentication. Apply the same fix to the sibling read bug, CVE-2026-48313. See the Adobe Security Bulletin APSB26-68. Patching is the only complete fix.
  • Preemptive blocking: Put the CrowdSec WAF in front of your ColdFusion servers to filter malicious /CFIDE/main/ide.cfm requests, and subscribe to the CrowdSec Intelligence Blocklists to pre-emptively drop traffic from the IPs already attacking our network.
  • Stay proactive: For instant monitoring of how this CVE evolves, follow the CrowdSec Live Exploit Tracker for CVE-2026-48282.

Unsure about where to start?: Check out our special 3-minute introduction track at: https://start.crowdsec.net

Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.

Want to stay ahead of the latest cyber threats? Get our weekly Threat Alert Newsletter delivered straight to your inbox, along with critical threat updates and trending cybersecurity insights. 📩 Sign up now for exclusive access

If you’re already subscribed, feel free to like and share this post to help your network stay informed about current threats.

WRITTEN BY