top of page

Adobe ColdFusion and Campaign Classic: Multiple Critical Vulnerabilities, One Actively Exploited (CVE-2026-48282)

July 15th, 2026

Critical

Our Cyber Threat Intelligence Unit is tracking multiple critical vulnerabilities affecting Adobe ColdFusion and Adobe Campaign Classic (ACC), disclosed in Adobe's security bulletins APSB26-68 and APSB26-69 on June 30, 2026. Together the bulletins address 12 vulnerabilities, including seven rated CVSS 10.0, that could allow unauthenticated remote code execution through unrestricted file upload, improper input validation, path traversal, server-side request forgery (SSRF), and reflected cross-site scripting (XSS). One of these, CVE-2026-48282, is confirmed under active exploitation: researchers detected in-the-wild attacks within roughly two hours of technical details becoming public, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on July 7, 2026, with a federal remediation deadline of July 10, 2026, that has already passed. The ACC vulnerability applies only to on-premise deployments; Adobe-hosted instances have already been remediated. Organizations operating affected on-premise deployments should treat patching as an immediate priority, particularly for internet-facing ColdFusion servers.

Technical Details

  • Severity: Critical

  • CVSS: Up to 10.0

  • Affected Products: Adobe ColdFusion 2025 and 2023, Adobe Campaign Classic v7 (on-premise)

  • Exploitation Status: CVE-2026-48282 confirmed exploited in the wild and listed in CISA's KEV catalog (added July 7, 2026); no confirmed exploitation reported for the remaining CVEs as of this advisory


Primary Focus: Unauthenticated RCE, CVSS 10.0 (Adobe ColdFusion, APSB26-68)

  • CVE-2026-48276: Unrestricted File Upload, unauthenticated RCE. File-upload functionality is disabled by default and must be explicitly enabled to be reachable.

  • CVE-2026-48283: Unrestricted File Upload, unauthenticated RCE.

  • CVE-2026-48277: Improper Input Validation, unauthenticated RCE.

  • CVE-2026-48281: Improper Input Validation, unauthenticated RCE.

  • CVE-2026-48316: Improper Input Validation, unauthenticated RCE.

  • CVE-2026-48282: Path Traversal, unauthenticated RCE. Actively exploited. Exploitation requires Remote Development Services (RDS) to be enabled with RDS authentication disabled; RDS is disabled by default.


Additional ColdFusion CVEs Addressed in APSB26-68 (lower CVSS, acknowledged for completeness)

  • CVE-2026-48313: Path Traversal, CVSS 9.3, arbitrary file system read.

  • CVE-2026-48315: Improper Input Validation, CVSS 9.3, privilege escalation, requires user interaction.

  • CVE-2026-48307: Reflected XSS, CVSS 8.8, RCE, adjacent-network attack vector, requires user interaction.

  • CVE-2026-48285: SSRF, CVSS 8.6, security feature bypass.

  • CVE-2026-48314: Path Traversal, CVSS 6.5, Important, privilege escalation.


Adobe Campaign Classic (APSB26-69)

  • CVE-2026-48286: Incorrect Authorization, CVSS 10.0, unauthenticated RCE, on-premise deployments only.


Affected Versions

  • ColdFusion 2025 Update 9 and earlier (fixed in Update 10)

  • ColdFusion 2023 Update 20 and earlier (fixed in Update 21)

  • ACC v7 build 9396 and earlier (fixed in build 9397)


Attack Chain:

  • Initial Access: An unauthenticated attacker sends crafted HTTP requests to an internet-facing ColdFusion or ACC instance.

  • Exploitation: The attacker uploads arbitrary files, submits malformed input, traverses the file system, or invokes unauthorized privileged functionality depending on the specific CVE. For CVE-2026-48282, this occurs through the RDS FILEIO endpoint on servers with RDS enabled and RDS authentication disabled.

  • Code Execution: Arbitrary code runs in the context of the service account, allowing deployment of web shells for persistence.

  • Post-Exploitation: The attacker may access datasource credentials in configuration files and move laterally to connected databases or directory services.

Image by ThisisEngineering

Impact

• Unauthenticated Remote Code Execution: Complete compromise of internet-facing ColdFusion or ACC servers.

• Active Exploitation Risk: Confirmed active exploitation of CVE-2026-48282 significantly raises near-term risk for unpatched, internet-exposed ColdFusion servers, particularly those running RDS with authentication disabled.

• Credential and Data Exposure: Exposure of datasource credentials, encryption keys, and configuration data via path traversal.

• Lateral Movement: Potential movement into connected databases, Active Directory, and enterprise systems following initial compromise.

• Operational Disruption: Service disruption from exploitation, incident response, or emergency patching of business-critical applications.

• Regulatory Exposure: Regulatory, financial, and reputational exposure for organizations handling regulated data on affected servers.

Detection Method

• Monitor ColdFusion, IIS/Apache, and web server logs for abnormal POST requests, file upload activity, and directory traversal sequences (../, %2e%2e%2f).

• Alert on the ColdFusion service (coldfusion.exe, cfserver.exe, java.exe) spawning command interpreters such as cmd.exe, powershell.exe, wscript.exe, or mshta.exe.

• Detect newly created or modified .cfm, .cfc, or .jsp files in ColdFusion web directories immediately following inbound HTTP requests.

• Specifically review requests to the RDS FILEIO endpoint (/CFIDE/main/ide.cfm?ACTION=FILEIO) for unauthorized file read/write activity.

• Inspect firewall, proxy, and EDR telemetry for outbound connections from the ColdFusion/ACC service to unfamiliar external hosts.

• Monitor access to sensitive configuration files (neo-datasource.xml, neo-security.xml, password.properties) for unexpected reads or modifications.

• Use vulnerability scanners to identify unpatched ColdFusion and ACC instances and prioritize remediation.

• If RDS is enabled, confirm whether RDS authentication is active; if disabled, treat the server as high priority for both patching and compromise review.

Indicators of Compromise

Type

Indicator

Description

IP Address

103.207.14[.]220

Source IP observed conducting CVE-2026-48282 exploitation attempts against the ColdFusion RDS FILEIO endpoint (KEVIntel honeypot detection, July 2, 2026)


mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

• Apply Adobe's security updates immediately: ColdFusion 2025 Update 10, ColdFusion 2023 Update 21, and ACC build 9397. Verify the installed build version after patching.

• Prioritize CVE-2026-48282 given confirmed active exploitation and its CISA KEV listing.

• Disable RDS if not strictly required; if RDS must remain enabled, ensure RDS authentication is active.

• Confirm whether the ACC deployment is on-premise or Adobe-hosted; hosted instances have already been remediated and require no action.

• Apply Adobe's ColdFusion Lockdown Guide hardening recommendations, including restricting upload folder permissions and validating uploaded content types.

• Enforce multi-factor authentication for all administrative accounts and apply least privilege to service accounts.

• Continuously monitor ColdFusion/ACC logs, process creation events, and outbound network activity for signs of exploitation.

• Review internet-facing deployments for unauthorized files or web shells; if compromise is suspected, isolate the server, rotate credentials, and conduct a forensic investigation before restoring service. Patching alone does not remediate a server that has already been compromised.

• Maintain offline or immutable backups of ColdFusion/ACC applications and databases, and periodically test restoration.

Conclusion

Adobe's APSB26-68 and APSB26-69 bulletins disclose 12 vulnerabilities across ColdFusion and Campaign Classic. Seven of these, six in ColdFusion and one in Campaign Classic, carry the maximum CVSS score of 10.0 and require no authentication or user interaction to exploit. One of them, CVE-2026-48282, is under confirmed active exploitation and has been added to CISA's Known Exploited Vulnerabilities catalog, making it the highest patching priority in this advisory. The remaining vulnerabilities, while not yet reported as exploited, share the same low attack complexity and widespread ColdFusion deployment in enterprise environments that make rapid patching a priority. Organizations should apply the available updates without delay, verify successful deployment, disable or lock down RDS where not required, and review internet-facing systems for signs of compromise. Continued monitoring of Adobe's advisories and CISA's KEV catalog is recommended for any further exploitation activity.

bottom of page