ColdFusion CVE-2026-48282: Exploited RDS Path Traversal

What to do

1. Install ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 (Adobe Priority 1) on every instance, including staging and internal servers.
2. Confirm RDS is disabled on production servers; if a developer workflow truly needs it, require RDS authentication and keep it off untrusted networks.
3. Block /CFIDE/main/ide.cfm at the reverse proxy or WAF for all external traffic.
4. Apply Adobe's lockdown guide and update the JDK/JRE to the latest supported LTS release, as the bulletin recommends.
5. If RDS was ever reachable without authentication on an unpatched server, treat it as compromised: hunt, rebuild if needed, and rotate secrets stored in ColdFusion.

How to check if you are affected or compromised

• Search web and proxy logs for POST requests to /CFIDE/main/ide.cfm with ACTION=FILEIO, the application/x-ColdFusionIDE content type, or the Dreamweaver-RDS-SCM1.00 user agent.
• Look for new or unfamiliar .cfm, .cfc, .jsp or .txt files under the ColdFusion web root (cfusion/wwwroot), especially files created after June 30, 2026.
• Check EDR or process logs for the ColdFusion JVM spawning cmd.exe, powershell.exe or shells, and for unexpected binaries in C:\ProgramData\.
• Review access to neo-security.xml and other ColdFusion configuration files, which attackers read after gaining a foothold.

What happened#

On June 30, 2026, Adobe published security bulletin APSB26-68 for ColdFusion 2025 and 2023, with Priority 1, its highest rating. It fixes a batch of critical and important bugs. One of them, CVE-2026-48282, is a path traversal flaw (CWE-22) that Adobe says can lead to arbitrary code execution as the ColdFusion service user. Adobe scores it CVSS 3.1 10.0. The bulletin, last revised July 13, states: "Adobe is aware that CVE-2026-48282 has been exploited in the wild in limited attacks targeting Adobe ColdFusion." CISA added it to the Known Exploited Vulnerabilities catalog on July 7, with a federal deadline of July 10.

Adobe gave no technical detail. On July 2, watchTowr Labs diffed the patch and found that the Remote Development Services (RDS) file handler accepted unvalidated paths. RDS is the protocol IDEs use to browse and edit files on a ColdFusion server. A POST /CFIDE/main/ide.cfm?ACTION=FILEIO request could read or write files anywhere on disk. Writing a CFML page into the web root and then requesting it gives code execution. watchTowr's "best guess" maps the write to CVE-2026-48282 and the read to CVE-2026-48313 (CVSS 9.3). It cautions that matching bugs to CVE IDs was uncertain. The fix canonicalizes paths and rejects traversal segments and null bytes.

Who is affected#

ColdFusion 2025 Update 9 and earlier and ColdFusion 2023 Update 20 and earlier, on all platforms. The fixes are ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. The CVE record and NVD carry the same ranges, and CISA's enrichment marks exploitation as active and automatable.

The exploited path needs two settings. RDS must be enabled, and per watchTowr's testing, RDS authentication must be turned off. watchTowr says RDS is not enabled by default. CrowdSec says neither setting is the default. The likely targets are servers where RDS was switched on for IDE access and never switched off, often developer, staging or legacy boxes.

Do you really need to act?#

If you run ColdFusion, yes: install the update. Adobe offers no workaround, and the same update fixes the other bulletin bugs. The panic level depends on RDS.

• RDS enabled without authentication, reachable from the internet: this is the exploited setup. Patching now does not undo a web shell planted since July, so hunt as well.
• RDS disabled: this exploit path does not apply. Patch on a short cycle anyway. The bulletin fixes other critical bugs, and CISA has added five ColdFusion CVEs to KEV since January 2024, this one included.
• No ColdFusion anywhere: nothing to do. Check for forgotten legacy apps before you decide that.

The exploitation is real but modest in scale. CrowdSec first saw exploitation on its network on July 20 and counts 107 unique attacking IPs. The campaign has since settled into what it calls "Limited Exploitation." Deepwatch reports honeypot hits and says a public, non-weaponized proof of concept exists.

What to do now#

1. Apply ColdFusion 2025 Update 10 or 2023 Update 21 to every instance, and confirm the reported update level afterwards.
2. Turn RDS off on anything that is not a developer workstation. If you must keep it, require RDS authentication. Deepwatch lists disabling the RDS servlet mapping in web.xml as a temporary workaround.
3. Deny external access to /CFIDE/main/ide.cfm (and ideally all of /CFIDE/) at the proxy or WAF. A quick external check: curl -s -o /dev/null -w '%{http_code}\n' -X POST 'https://your-host/CFIDE/main/ide.cfm?ACTION=FILEIO' should be blocked before it reaches ColdFusion.
4. Follow Adobe's bulletin guidance: review the ColdFusion lockdown guide and move to the latest supported JDK/JRE LTS update.

How to tell if you were hit#

Search access logs for the RDS pattern: grep -i 'ide.cfm' access.log | grep -i 'fileio'. Deepwatch also flags the application/x-ColdFusionIDE content type, the Dreamweaver-RDS-SCM1.00 user agent, and traversal strings such as ../ and %2e%2e%2f in request bodies. CrowdSec saw attackers confirm a write by fetching a .txt file under /CFIDE/. Then look on disk for planted files: find <cf_root>/cfusion/wwwroot -type f \( -name '*.cfm' -o -name '*.cfc' -o -name '*.jsp' \) -newermt 2026-06-30. Check EDR for the ColdFusion JVM spawning cmd.exe or powershell.exe. Deepwatch also names rs64c.exe in C:\ProgramData\ as a follow-on artifact. If you find a shell, assume the attacker read neo-security.xml and the datasource credentials. Rotate those credentials and rebuild the server.

Greenbone ships a banner-based scanner check for affected versions if you need to sweep a large estate.

Timeline#

• Jun 30, 2026 — Adobe publishes APSB26-68 (Priority 1) and the CVE record.
• Jul 2, 2026 — watchTowr publishes its patch analysis of the RDS file read and write bugs.
• Jul 7, 2026 — CISA adds CVE-2026-48282 to KEV, with a federal deadline of July 10.
• Jul 13, 2026 — Latest revision of Adobe's bulletin, which states limited in-the-wild exploitation.
• Jul 20, 2026 — CrowdSec first observes exploitation on its network. By July 24 it rates the campaign "Early Exploitation", later easing to "Limited Exploitation".

Vulnerability records

• CVE-2026-48282 · KEV 2026-07-07 · ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…
• CVE-2026-48313 · ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Adobe — APSB26-68: Security updates available for Adobe ColdFusion adobe.com
2. CVE record — CVE-2026-48282 cve.org
3. NVD — CVE-2026-48282 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2026-48282 cisa.gov
5. watchTowr Labs — Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza labs.watchtowr.com
6. CrowdSec — CVE-2026-48282: Adobe ColdFusion RDS path traversal RCE crowdsec.net
7. Deepwatch — CA-26-024: Active exploitation of Adobe ColdFusion RDS path traversal (CVE-2026-48282) deepwatch.com
8. Greenbone — CVE-2026-48282: Adobe ColdFusion actively exploited greenbone.net