Adobe ColdFusion deployments 2026 exploit breach

In early July 2026, attackers began exploiting CVE-2026-48282, a maximum-severity vulnerability in Adobe ColdFusion that Adobe had patched on 30 June 2026 alongside nine other critical flaws. The bug is a path traversal in the Remote Development Services (RDS) file I/O handler that lets an unauthenticated attacker write files and achieve remote code execution on the server.

Vulnerability-intelligence firm KEVIntel detected exploitation attempts against its honeypots on 2 July, the same day watchTowr researchers published a technical analysis. On 7 and 8 July, the flaw was added to CISA's Known Exploited Vulnerabilities catalog, with U.S. federal civilian agencies ordered to remediate by 10 July.

Exposure

Exploitation requires RDS to be enabled with RDS authentication disabled, which is not the default configuration, limiting the pool of vulnerable servers. The Shadowserver Foundation tracked roughly 750 internet-facing ColdFusion servers. Fixed versions are ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, and defenders were advised to hunt for unexpected files in the web root and the /CFIDE/ directory.

Why it matters

ColdFusion remains common in government, financial and healthcare web stacks, and it has a long history of being exploited soon after patches are released. The near-immediate weaponization of CVE-2026-48282 is another sign that the window between a patch and mass exploitation is now measured in hours or days, which leaves organizations with slow patch cycles exposed by default.

Timeline

June 30, 2026

Adobe patches CVE-2026-48282 and nine other critical ColdFusion flaws in a security bulletin.

July 2, 2026

KEVIntel honeypot sensors capture in-the-wild exploitation; watchTowr publishes technical analysis.

July 7, 2026

Exploitation is widely reported; CISA adds the flaw to its Known Exploited Vulnerabilities catalog and sets a 10 July remediation deadline for federal agencies.

Sources

helpnetsecurity.comhttps://www.helpnetsecurity.com/2026/07/07/adobe-coldfusion-cve-2026-48282-exploitation-detected/

bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/max-severity-adobe-coldfusion-flaw-now-exploited-in-attacks/

securityweek.comhttps://www.securityweek.com/critical-adobe-coldfusion-vulnerability-exploited-in-attacks/

Related incidents

Vulnerability exploitOngoingAugust 17, 2026

Mass exploitation of Zimbra SNMP flaw (CVE-2026-73570) compromises hundreds of mail servers

Attackers exploited CVE-2026-73570, an unauthenticated command injection flaw in Zimbra Collaboration Suite's SNMP notification handling, compromising at least 274 internet-facing mail servers within days of CERT Polska confirming exploitation.

Victim: Zimbra Collaboration Suite

Vulnerability exploitOngoingAugust 13, 2026

VMware vCenter Syslog flaw exploited at scale and by ransomware (CVE-2026-59310)

Attackers began exploiting CVE-2026-59310, a critical unauthenticated remote code execution flaw in the VMware vCenter Syslog server, days after Broadcom patched it, compromising more than 360 systems in 47 countries; CISA later flagged the bug as used in ransomware campaigns.

Victim: VMware vCenter Server (Broadcom)

Vulnerability exploitOngoingJuly 24, 2026

Cl0p exploits PTC Windchill and FlexPLM flaw in data-theft campaign

Researchers reported that Cl0p was exploiting CVE-2026-12569 in internet-exposed PTC Windchill and FlexPLM product lifecycle management servers to steal engineering data, sending extortion emails to victims from 20 July 2026.

Victim: PTC Windchill and FlexPLM customers (Cl0p campaign)

Vulnerability exploitContainedJuly 16, 2026

Hugging Face says an autonomous AI agent breached its production infrastructure

Hugging Face disclosed that an intrusion driven end-to-end by an autonomous AI agent exploited two code-execution flaws in its dataset pipeline to reach internal clusters and credentials, executing more than 17,000 logged actions before being contained.

Victim: Hugging Face