What is the CVSS score of CVE-2026-48282?

CVE-2026-48282 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Adobe ColdFusion are affected by CVE-2026-48282?

A critical, unauthenticated path traversal vulnerability in Adobe ColdFusion 2025.9 and 2023.20 allows attackers to execute arbitrary code on affected systems without user interaction.

Is there a public PoC exploit available for CVE-2026-48282?

Yes, a public proof-of-concept exploit is available for CVE-2026-48282. Prioritise patching immediately. EPSS: 1.0%.

How to fix or mitigate CVE-2026-48282?

24 hours: Identify all systems running Adobe ColdFusion 2025.9, 2023.20, or earlier versions; isolate affected systems from production networks if possible. 7 days: Deploy WAF rules to block path traversal patterns (e.g., ../, ..\ encodings); restrict network access to ColdFusion instances; enable comprehensive application logging. 30 days: Monitor Adobe security advisories daily; prepare upgrade plan to patched version once available; monitor logs for exploitation attempts; consider platform migration if patch timeline is unacceptable.

Adobe ColdFusion CVE-2026-48282

EUVD-2026-40339 CRITICAL

Path Traversal (CWE-22)

2026-06-30 adobe

GHSA-jfrp-7pp5-772c

Path Traversal RCE Coldfusion

10.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network path traversal with no user interaction yields arbitrary code execution; scope changes as code runs beyond the app's security boundary, with full C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jul 07, 2026 - 19:32 CISA

Analysis Generated

Jun 30, 2026 - 16:23 vuln.today

CVE Published

Jun 30, 2026 - 15:11 nvd

CRITICAL 10.0

DescriptionCVE.org

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Articles & Coverage 1

POC CVE-2026-48282: Critical Path Traversal RCE in Adobe ColdFusion RDS (CVSS 10.0) Jul 07, 2026

AnalysisAI

Path traversal in Adobe ColdFusion 2025.9, 2023.20 and earlier enables remote, unauthenticated attackers to write or access files outside intended directories and achieve arbitrary code execution in the context of the current user. Rated CVSS 10.0 with a changed scope and no user interaction required, this is among the most severe ColdFusion flaws possible. No public exploit identified at time of analysis, but the impact and trivial attack complexity make it a top patching priority.

Technical ContextAI

ColdFusion is Adobe's commercial application server and rapid web-application development platform built on Java, commonly deployed as an internet-facing web application engine. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. Path Traversal): attacker-controlled path input is not properly sanitized, allowing sequences such as '../' to escape an intended restricted directory. In ColdFusion this class of flaw historically permits writing or reading files at arbitrary filesystem locations, which can be chained into code execution when an attacker plants or invokes a payload (e.g. a CFM/JSP file or overwrites a script the server executes). The CPE cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:* confirms the affected product is the Adobe ColdFusion application (all matching versions up to the fixed builds).

RemediationAI

Apply Adobe's security update as published in advisory APSB26-68 (https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html); upgrade beyond ColdFusion 2025.9 and 2023.20 to the patched builds listed by Adobe. Patch available per vendor advisory - install the latest cumulative update for your release train and verify the post-install build number. Until patched, restrict network exposure by placing ColdFusion behind a WAF or reverse proxy and blocking external access to the ColdFusion administrative and internal endpoints, apply Adobe's published Lockdown Guide to constrain filesystem permissions of the service account (limiting what arbitrary file writes can achieve), and remove unused or internet-facing CFM endpoints; note these controls reduce but do not eliminate exposure and may break legitimate integrations, so they are stopgaps pending the patch.