Six CVSS 10 Flaws Hit ColdFusion. One Was Already Being Exploited.
ColdFusion CVE-2026-48282 was already being exploited when Adobe’s June bulletin disclosed six separate CVSS 10 vulnerabilities capable of arbitrary code execution. The update contained 13 CVEs in total.
APSB26-68 affects ColdFusion 2025 Update 9 and earlier and ColdFusion 2023 Update 20 and earlier. Adobe fixed the issues in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. The bulletin contains 13 CVEs, not one interchangeable ColdFusion problem, and each has different prerequisites and consequences.
The exploited issue is a path traversal that can lead to arbitrary code execution. Five other flaws received the same maximum score even though Adobe did not report exploitation of them.
Every vulnerability in APSB26-68
| Vulnerability | Impact and prerequisites | Exploitation or PoC status |
|---|---|---|
| CVE-2026-48276 | Unrestricted upload leading to arbitrary code execution; critical, CVSS 10.0 | No exploitation confirmed by Adobe in the bulletin |
| CVE-2026-48277 | Improper input validation leading to arbitrary code execution; critical, CVSS 10.0 | No exploitation confirmed by Adobe |
| CVE-2026-48281 | Improper input validation leading to arbitrary code execution; critical, CVSS 10.0 | No exploitation confirmed by Adobe |
| CVE-2026-48316 | Improper input validation leading to arbitrary code execution; critical, CVSS 10.0 | No exploitation confirmed by Adobe |
| CVE-2026-48282 | Path traversal leading to arbitrary code execution; critical, CVSS 10.0 | Adobe confirmed limited exploitation |
| CVE-2026-48283 | Unrestricted upload leading to arbitrary code execution; critical, CVSS 10.0 | No exploitation confirmed by Adobe |
| CVE-2026-48313 | Path traversal leading to arbitrary file read; critical, CVSS 9.3 | No exploitation confirmed by Adobe |
| CVE-2026-48315 | Improper input validation leading to privilege escalation; critical, CVSS 9.3, user interaction required | No exploitation confirmed by Adobe |
| CVE-2026-48307 | Reflected cross-site scripting leading to arbitrary code execution; critical, CVSS 8.8, adjacent network and user interaction required | No exploitation confirmed by Adobe |
| CVE-2026-48285 | Server-side request forgery leading to security-feature bypass; critical, CVSS 8.6 | No exploitation confirmed by Adobe |
| CVE-2026-48363 | Uncontrolled search path leading to privilege escalation; critical, CVSS 8.2, local access, low privileges and user interaction required | No exploitation confirmed by Adobe |
| CVE-2026-48364 | Uncontrolled search path leading to privilege escalation; critical, CVSS 8.2, local access, low privileges and user interaction required | No exploitation confirmed by Adobe |
| CVE-2026-48314 | Path traversal leading to privilege escalation; important, CVSS 6.5 | No exploitation confirmed by Adobe |
One exploited flaw should not hide the other five maximum-score paths
Confirmed exploitation establishes the immediate priority for hunting around the path-traversal issue. It does not make the other flaws secondary. Unrestricted upload and input-validation failures can produce the same end state: attacker-controlled code running in a ColdFusion environment that may sit beside databases, credentials and internal applications.
Adobe classifies the update as Priority 1. The vendor recommends installing the fixed build, using the latest MySQL connector, applying serial-filter protections, running a supported JDK and following the ColdFusion lockdown guidance. Those hardening steps matter, but they do not replace the security update.
What defenders should do
- Install ColdFusion 2025 Update 10 or 2023 Update 21. Verify the deployed build after the service returns.
- Investigate exploitation before declaring success. Review file creation, web-root changes, ColdFusion logs, web-server access, child processes and outbound connections.
- Search for upload and traversal attempts. Do not limit hunting to the one CVE Adobe marked as exploited because the bulletin contains multiple independent code-execution paths.
- Validate connectors and Java support. Use the current MySQL connector and a JDK supported by the relevant ColdFusion release.
- Apply serial filters and lockdown controls. Compare the production configuration against Adobe’s security guidance, especially on internet-facing servers.
- Rotate exposed secrets after scoping. If compromise is suspected, determine which database, service and application credentials the ColdFusion process could access.
The BlackTree view
A headline that says one ColdFusion flaw was exploited can conceal the bulletin’s real shape. Six separate vulnerabilities reached CVSS 10, while seven more created file-read, privilege-escalation, cross-site scripting and SSRF paths.
Patch the entire bulletin, then investigate the exploited path. Coverage of one CVE is not coverage of the other twelve, and one clean indicator is not proof that a server escaped every available route.
Sources and publication details
- Adobe Security Bulletin APSB26-68, initially published 30 June 2026 and updated 13 July 2026. No publication times were provided.
