CVE-2026-48282: Adobe ColdFusion Path Traversal RCE (KEV, exploited)

CVE-2026-48282 is a path-traversal vulnerability (CWE-22) in Adobe ColdFusion 2025 Update 9 and earlier, and 2023 Update 20 and earlier, that can lead to arbitrary code execution in the context of the current user without any user interaction, and Adobe itself disclosed that it has been exploited in the wild in limited, targeted attacks before most installations could patch.

CVE-2026-48282 affects Adobe ColdFusion, a web application server. NVD's description states that "ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user," and that "Exploitation of this issue does not require user interaction" (NVD).

Adobe's own CNA submission, which NVD stores as a Secondary (not NVD-confirmed) metric, scores this CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, and a changed scope reflecting that a path traversal on the web server can reach outside the vulnerable component to execute code. CWE-22 (Path Traversal) is the assigned weakness (NVD).

Adobe's own security bulletin APSB26-68 (priority rating 1, published 2026-06-30) states plainly: "Adobe is aware that CVE-2026-48282 has been exploited in the wild in limited attacks targeting Adobe ColdFusion." The bulletin lists ColdFusion 2025 Update 9 and earlier, and ColdFusion 2023 Update 20 and earlier, as affected on all platforms, with fixes in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21 (Adobe Security Bulletin APSB26-68).

CISA added CVE-2026-48282 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-07, with a required-action due date of 2026-07-10 — a 3-day window — and flags the entry for CISA's forensic-triage requirements, while recording knownRansomwareCampaignUse as "Unknown" (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.4239 (98.699th percentile), consistent with Adobe's own disclosure of in-the-wild exploitation (FIRST EPSS).

Because Adobe itself confirms active exploitation and the flaw needs no user interaction to reach code execution, any ColdFusion 2025 instance at Update 9 or earlier, or 2023 instance at Update 20 or earlier, should be updated to 2025 Update 10 / 2023 Update 21 immediately and checked for signs of prior compromise.

• Path traversal (CWE-22) in ColdFusion 2025.9, 2023.20 and earlier can lead to arbitrary code execution in the context of the current user, with no user interaction required. — NVD
• CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, submitted by Adobe's own CNA and stored by NVD as a Secondary (not NVD-confirmed) metric. — NVD
• Adobe states CVE-2026-48282 "has been exploited in the wild in limited attacks targeting Adobe ColdFusion." Affected: ColdFusion 2025 Update 9 and earlier, 2023 Update 20 and earlier; fixed in 2025 Update 10 and 2023 Update 21. — Adobe Security Bulletin APSB26-68
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-07-07, required action due 2026-07-10 (3-day window), flagged for forensic triage; knownRansomwareCampaignUse recorded as "Unknown". — CISA KEV
• EPSS score is 0.4239 (98.699th percentile) as of 2026-10-29. — FIRST EPSS