---
title: "ColdFusion CVE-2026-48282: Exploited RDS Path Traversal"
url: https://erroneo.us/security/briefs/adobe-coldfusion-cve-2026-48282-rds-path-traversal/
description: "Unauthenticated file write to RCE in ColdFusion 2025/2023 when RDS is on without auth. Exploited, in KEV. Fixed in 2025 Update 10 and 2023 Update 21."
type: security-brief
section: "Security Digest"
date_published: 2026-06-30
date_modified: 2026-07-20
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-48282", "CVE-2026-48313"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ColdFusion CVE-2026-48282: Exploited RDS Path Traversal

**Verdict: Check exposure.** Every ColdFusion 2023/2025 server should already be on the June updates; if RDS was enabled without authentication and reachable, assume the box may be compromised and hunt.

- **Who must act:** Anyone running ColdFusion 2025 Update 9 or 2023 Update 20 and earlier, most urgently servers where Remote Development Services (RDS) is enabled, unauthenticated, and reachable from untrusted networks.
- **Who can relax:** Teams that do not run ColdFusion, and ColdFusion servers that are already on 2025 Update 10 or 2023 Update 21 with RDS disabled, which is not the exploited configuration.
- **Affected:** ColdFusion 2025 Update 9 and earlier; ColdFusion 2023 Update 20 and earlier
- **Fixed:** ColdFusion 2025 Update 10; ColdFusion 2023 Update 21
- **CVEs:** CVE-2026-48282, CVE-2026-48313
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Install ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 (Adobe Priority 1) on every instance, including staging and internal servers.
2. Confirm RDS is disabled on production servers; if a developer workflow truly needs it, require RDS authentication and keep it off untrusted networks.
3. Block /CFIDE/main/ide.cfm at the reverse proxy or WAF for all external traffic.
4. Apply Adobe's lockdown guide and update the JDK/JRE to the latest supported LTS release, as the bulletin recommends.
5. If RDS was ever reachable without authentication on an unpatched server, treat it as compromised: hunt, rebuild if needed, and rotate secrets stored in ColdFusion.

### How to check if you are affected

- Search web and proxy logs for POST requests to /CFIDE/main/ide.cfm with ACTION=FILEIO, the application/x-ColdFusionIDE content type, or the Dreamweaver-RDS-SCM1.00 user agent.
- Look for new or unfamiliar .cfm, .cfc, .jsp or .txt files under the ColdFusion web root (cfusion/wwwroot), especially files created after June 30, 2026.
- Check EDR or process logs for the ColdFusion JVM spawning cmd.exe, powershell.exe or shells, and for unexpected binaries in C:\ProgramData\.
- Review access to neo-security.xml and other ColdFusion configuration files, which attackers read after gaining a foothold.

## What happened

On June 30, 2026, Adobe published security bulletin [APSB26-68](https://www.adobe.com/trust/security/products/coldfusion/apsb26-68) for ColdFusion 2025 and 2023, with Priority 1, its highest rating. It fixes a batch of critical and important bugs. One of them, CVE-2026-48282, is a path traversal flaw (CWE-22) that Adobe says can lead to arbitrary code execution as the ColdFusion service user. Adobe scores it CVSS 3.1 10.0. The bulletin, last revised July 13, states: "Adobe is aware that CVE-2026-48282 has been exploited in the wild in limited attacks targeting Adobe ColdFusion." CISA added it to the [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282) on July 7, with a federal deadline of July 10.

Adobe gave no technical detail. On July 2, [watchTowr Labs](https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/) diffed the patch and found that the Remote Development Services (RDS) file handler accepted unvalidated paths. RDS is the protocol IDEs use to browse and edit files on a ColdFusion server. A `POST /CFIDE/main/ide.cfm?ACTION=FILEIO` request could read or write files anywhere on disk. Writing a CFML page into the web root and then requesting it gives code execution. watchTowr's "best guess" maps the write to CVE-2026-48282 and the read to CVE-2026-48313 (CVSS 9.3). It cautions that matching bugs to CVE IDs was uncertain. The fix canonicalizes paths and rejects traversal segments and null bytes.

## Who is affected

ColdFusion 2025 Update 9 and earlier and ColdFusion 2023 Update 20 and earlier, on all platforms. The fixes are ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-48282) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-48282) carry the same ranges, and CISA's enrichment marks exploitation as active and automatable.

The exploited path needs two settings. RDS must be enabled, and per watchTowr's testing, RDS authentication must be turned off. watchTowr says RDS is not enabled by default. [CrowdSec](https://www.crowdsec.net/vulntracking-report/cve-2026-48282-adobe-coldfusion-rds-path-traversal-rce) says neither setting is the default. The likely targets are servers where RDS was switched on for IDE access and never switched off, often developer, staging or legacy boxes.

## Do you really need to act?

If you run ColdFusion, yes: install the update. Adobe offers no workaround, and the same update fixes the other bulletin bugs. The panic level depends on RDS.

- **RDS enabled without authentication, reachable from the internet:** this is the exploited setup. Patching now does not undo a web shell planted since July, so hunt as well.
- **RDS disabled:** this exploit path does not apply. Patch on a short cycle anyway. The bulletin fixes other critical bugs, and CISA has added five ColdFusion CVEs to KEV since January 2024, this one included.
- **No ColdFusion anywhere:** nothing to do. Check for forgotten legacy apps before you decide that.

The exploitation is real but modest in scale. CrowdSec first saw exploitation on its network on July 20 and counts 107 unique attacking IPs. The campaign has since settled into what it calls "Limited Exploitation." [Deepwatch](https://www.deepwatch.com/labs/ca-26-024-active-exploitation-of-adobe-coldfusion-remote-development-services-path-traversal-and-remote-code-execution-cve-2026-48282/) reports honeypot hits and says a public, non-weaponized proof of concept exists.

## What to do now

1. Apply ColdFusion 2025 Update 10 or 2023 Update 21 to every instance, and confirm the reported update level afterwards.
2. Turn RDS off on anything that is not a developer workstation. If you must keep it, require RDS authentication. Deepwatch lists disabling the RDS servlet mapping in `web.xml` as a temporary workaround.
3. Deny external access to `/CFIDE/main/ide.cfm` (and ideally all of `/CFIDE/`) at the proxy or WAF. A quick external check: `curl -s -o /dev/null -w '%{http_code}\n' -X POST 'https://your-host/CFIDE/main/ide.cfm?ACTION=FILEIO'` should be blocked before it reaches ColdFusion.
4. Follow Adobe's bulletin guidance: review the ColdFusion lockdown guide and move to the latest supported JDK/JRE LTS update.

## How to tell if you were hit

Search access logs for the RDS pattern: `grep -i 'ide.cfm' access.log | grep -i 'fileio'`. Deepwatch also flags the `application/x-ColdFusionIDE` content type, the `Dreamweaver-RDS-SCM1.00` user agent, and traversal strings such as `../` and `%2e%2e%2f` in request bodies. CrowdSec saw attackers confirm a write by fetching a `.txt` file under `/CFIDE/`. Then look on disk for planted files: `find <cf_root>/cfusion/wwwroot -type f \( -name '*.cfm' -o -name '*.cfc' -o -name '*.jsp' \) -newermt 2026-06-30`. Check EDR for the ColdFusion JVM spawning `cmd.exe` or `powershell.exe`. Deepwatch also names `rs64c.exe` in `C:\ProgramData\` as a follow-on artifact. If you find a shell, assume the attacker read `neo-security.xml` and the datasource credentials. Rotate those credentials and rebuild the server.

[Greenbone](https://www.greenbone.net/en/blog/cve-2026-48282-adobe-coldfusion-actively-exploited/) ships a banner-based scanner check for affected versions if you need to sweep a large estate.

## Timeline

- Jun 30, 2026 — Adobe publishes APSB26-68 (Priority 1) and the CVE record.
- Jul 2, 2026 — watchTowr publishes its patch analysis of the RDS file read and write bugs.
- Jul 7, 2026 — CISA adds CVE-2026-48282 to KEV, with a federal deadline of July 10.
- Jul 13, 2026 — Latest revision of Adobe's bulletin, which states limited in-the-wild exploitation.
- Jul 20, 2026 — CrowdSec first observes exploitation on its network. By July 24 it rates the campaign "Early Exploitation", later easing to "Limited Exploitation".

## Sources

1. [Adobe — APSB26-68: Security updates available for Adobe ColdFusion](https://www.adobe.com/trust/security/products/coldfusion/apsb26-68)
2. [CVE record — CVE-2026-48282](https://www.cve.org/CVERecord?id=CVE-2026-48282)
3. [NVD — CVE-2026-48282](https://nvd.nist.gov/vuln/detail/CVE-2026-48282)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-48282](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282)
5. [watchTowr Labs — Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza](https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/)
6. [CrowdSec — CVE-2026-48282: Adobe ColdFusion RDS path traversal RCE](https://www.crowdsec.net/vulntracking-report/cve-2026-48282-adobe-coldfusion-rds-path-traversal-rce)
7. [Deepwatch — CA-26-024: Active exploitation of Adobe ColdFusion RDS path traversal (CVE-2026-48282)](https://www.deepwatch.com/labs/ca-26-024-active-exploitation-of-adobe-coldfusion-remote-development-services-path-traversal-and-remote-code-execution-cve-2026-48282/)
8. [Greenbone — CVE-2026-48282: Adobe ColdFusion actively exploited](https://www.greenbone.net/en/blog/cve-2026-48282-adobe-coldfusion-actively-exploited/)

---
Source page: https://erroneo.us/security/briefs/adobe-coldfusion-cve-2026-48282-rds-path-traversal/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt