ColdFusion's quiet twin: the CVSS-10 file-upload RCE hiding behind the one everyone's patching (CVE-2026-48276)

Every big vendor bulletin has a headline bug. Adobe's APSB26-68 had CVE-2026-48282 — a ColdFusion path-traversal that was exploited within about two hours of the technical write-up going public and landed on CISA's KEV list days later. But it had a twin. Buried in the same update is a second, structurally different max-severity flaw that ends in exactly the same place: an attacker-uploaded file running as the ColdFusion service account. It has no public proof-of-concept, no Nuclei template, and no honeypot hits — yet. This is the quiet one, and the reason it matters is that most teams will fix the loud one and never realise they closed this too — or, worse, mitigate the loud one a way that leaves this open.

What the flaw actually is

At its core the bug is a missing check. A ColdFusion upload handler accepts a file without properly validating its type, then stores it somewhere ColdFusion will later execute. Hand it a file with an executable ColdFusion extension — a .cfm or .cfc, or a servlet-executable .jsp — and it lands in a web-served directory as a live web shell. Adobe classifies it as CWE-434, Unrestricted Upload of File with Dangerous Type, and the scored vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — a clean 10.0, reachable over the network with no login and no user interaction (NVD, CCB Belgium). The Scope: Changed flag is there because ColdFusion typically runs as a highly privileged account, so code lands as NT AUTHORITY\SYSTEM on Windows or root on Linux.

Where exactly is the vulnerable handler? Here the honest answer is probably, but not confirmed. Adobe's advisory names no endpoint. The most detailed public analysis, from watchTowr Labs, tentatively pins it on the CKEditor filemanager upload component (/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm), reachable without authentication once file uploads are enabled — but the researchers explicitly file it under "CVE-2026-48276 (maybe)" and warn that matching individual CVE IDs to bugs across this 11-CVE bulletin is unreliable (watchTowr). Treat the endpoint as a strong hint for hunting, not gospel. Notably, it is the same CKEditor filemanager plugin family that was abused in 2023's CVE-2023-26360 to breach a US federal agency.

The quiet twin: CVE-2026-48276 vs the KEV'd CVE-2026-48282

These are two different bugs that reach the same outcome. One writes a file through a path traversal in the RDS FILEIO endpoint; the other writes a file by simply not checking what you uploaded. Both end in a web shell running as the service account. The only real difference today is how much noise each is making — and that gap is exactly where teams get caught.

From an upload to SYSTEM: the chain

The chain is short and entirely mechanical, which is what makes an unauthenticated CVSS-10 upload bug so dangerous. An attacker sends a multipart POST carrying an executable ColdFusion or JSP payload; the handler writes it into a web-served directory because it never rejected the dangerous type; the attacker then requests that file over HTTP, and ColdFusion compiles and runs it — spawning commands via <cfexecute>, a Java Runtime.exec call, or a <cfhttp>/<cffile> downloader. From there it is a web shell with the privileges of the ColdFusion service. The chokepoints a defender actually controls are the perimeter (block the filemanager path), the config (don't leave uploads enabled), the patch (kills the write), and least-privilege (so a shell isn't automatically SYSTEM).

Am I affected?

If you run on-prem Adobe ColdFusion below the fixed builds, yes. The exposure that matters most is an internet-facing instance where an application has file uploads enabled — but because the same update also fixes the actively-exploited path-traversal twin, the practical answer for any unpatched ColdFusion is "patch on the emergency track."

How urgent is it, really?

Taken alone, the signals look calm: not on KEV, and an EPSS score under one percent. Do not read that as an all-clear. EPSS measures observed exploitation of this specific ID, and a brand-new bug with no public exploit and a config gate is expected to score low — it is a statement about today, not about the ceiling. The impact ceiling is a perfect 10: unauthenticated, SYSTEM-level code execution. And ColdFusion's history is brutal — the same class of bug breached a federal agency in 2023, and a broker-style campaign has been farming ColdFusion at scale. Use "not KEV, low EPSS" to rank this within the patch wave, not to carve it out of it. If a public PoC lands, its risk profile snaps to its twin's overnight.

How it unfolded

The two twins were born the same day. One was weaponised almost immediately; the other has stayed dormant.

Detection and hunting

You are hunting for two things: exposure (unpatched ColdFusion where uploads are reachable) and compromise (a shell that was already dropped). Start by fingerprinting ColdFusion and confirming the applied update level — patched vs vulnerable comes down to the build number.

$ # External fingerprint — is this a ColdFusion box, and what build?$ curl -sI https://HOST/CFIDE/administrator/index.cfm$ curl -s  https://HOST/cf_scripts/scripts/    # CKEditor/AJAX assets = the exploit's surface$ # Applied update level (compare to 2025 Update 10 / 2023 Update 21):$ #   Administrator console  ->  System Information$ #   CFML at runtime        ->  server.coldfusion.productversion / productlevel$ #   On disk                ->  /cfusion/hf-updates/hf--/$ #                              /cfusion/lib/   (jar versions)

For compromise, the highest-fidelity signal is the request pair the exploit produces: an unauthenticated POST to the CKEditor filemanager path, immediately followed by a GET (HTTP 200) to a newly-created .cfm/.cfc/.jsp with a short or random name. On disk, hunt for executable files that don't belong in the ColdFusion web root, /CFIDE/, /cf_scripts/, or the Tomcat work/staging directory. The concrete filenames and TTPs from the 2023 CVE-2023-26360 campaign — .cfm shells with <cfexecute>, JSP shells like d.jsp/Connection.jsp, certutil.exe -urlcache downloaders, and w3wp/ColdFusion spawning cmd/powershell — are excellent hunting patterns to reuse here (CISA AA23-339A, Rapid7).

title: Suspicious POST to ColdFusion CKEditor FileManager Upload Endpoint
id: 4c2f9a10-7d3e-4b8a-9d21-3e6f0a1c48f0
status: experimental
description: HTTP POST to the ColdFusion CKEditor filemanager upload paths with directory traversal - the attack surface for ColdFusion file-upload RCE (same plugin family as CVE-2023-26360; reported for CVE-2026-48276 / APSB26-68). Generic, not a 48276 0day sig.
tags: [attack.initial_access, attack.t1190, attack.persistence, attack.t1505.003]
logsource:
  category: webserver
detection:
  selection_path:
    cs-method: 'POST'
    c-uri|contains:
      - '/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/'
      - '/CFIDE/scripts/ajax/ckeditor/plugins/filemanager/'
  selection_traversal:
    c-uri|contains: ['../', '..%2f', '..%5c', '%2e%2e%2f']
  condition: selection_path and selection_traversal
falsepositives:
  - Authenticated developer use of the CKEditor file manager
level: high

title: Suspicious GET to ColdFusion Executable File in Upload/CFIDE Directories
id: b71e0c94-2a56-4f2d-8c0b-9a2d7e15c3aa
status: experimental
description: Successful GET to .cfm/.cfc/.cfml/.jsp under ColdFusion static/upload dirs that should not host user templates - retrieving a dropped web shell after an upload RCE. Pair with the upload-abuse rule.
tags: [attack.persistence, attack.t1505.003, attack.execution]
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'GET'
    sc-status: 200
    c-uri|contains:
      - '/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/'
      - '/CFIDE/scripts/'
      - '/CFIDE/administrator/'
      - '/cf_scripts/scripts/'
  selection_ext:
    c-uri|contains: ['.cfm', '.cfml', '.cfc', '.jsp']
  condition: selection and selection_ext
falsepositives:
  - Legitimate components under /CFIDE/administrator/ (allowlist known filenames)
level: high

rule CFML_ColdFusion_WebShell_Generic
{
    meta:
        description = "Generic CFML web shells (cfexecute / Java Runtime / cfhttp downloader). Not 48276-specific."
        reference = "CISA AA23-339A"
        mitre = "T1505.003"
    strings:
        $cfexecute="

rule JSP_ColdFusion_WebShell_Generic
{
    meta:
        description = "Generic JSP shells dropped via ColdFusion upload RCE (d.jsp/Connection.jsp per CVE-2023-26360). Not 48276-specific."
        reference = "CISA AA23-339A"
        mitre = "T1505.003"
    strings:
        $jsp1="<%@ page" nocase
        $jsp2="<%"
        $exec1="Runtime.getRuntime().exec" nocase
        $exec2="ProcessBuilder" nocase
        $req="request.getParameter" nocase
        $rt="getRuntime" nocase
        $io1="getInputStream" nocase
        $io2="BufferedReader" nocase
    condition:
        filesize < 200KB and ($jsp1 or $jsp2) and $req and
        (($exec1 or ($exec2 and $rt)) and ($io1 or $io2))
}

What to do now

1. Patch on the emergency track. Apply APSB26-68 — ColdFusion 2025 Update 10, or 2023 Update 21. This is the durable fix and it closes the actively-exploited CVE-2026-48282 in the same step. ColdFusion 2021 is EOL: migrate or retire it.
2. If you truly can't patch yet, bridge it. Disable file uploads where an app doesn't need them and lock down the CKEditor filemanager; disable RDS or set an RDS password (that's the twin's path); block /CFIDE/ and /cf_scripts/ from untrusted networks at the WAF.
3. Run ColdFusion as a least-privilege account, not SYSTEM/root. Per Adobe's Lockdown Guide — this single control means a successful upload doesn't hand over the whole host.
4. Assume-exposure hunt. Patching evicts nothing already dropped, and the twin was exploited within ~2 hours of disclosure. Hunt for web shells in the web root and CFIDE directories, and run the detection rules over historical logs back to 2026-06-30.
5. Track "mitigated" separately from "patched." A box where you disabled RDS but didn't apply the update is still exposed to the file-upload bug.

FAQ

Sources

• NVD — CVE-2026-48276
• NVD — CVE-2026-48282 (the KEV'd twin)
• Adobe Security Bulletin APSB26-68
• watchTowr Labs — APSB26-68 technical analysis
• CCB Belgium — advisory (CVE-2026-48276, CVSS 10.0)
• Qualys ThreatPROTECT — ColdFusion critical patches
• Greenbone — CVE-2026-48282 actively exploited
• BleepingComputer — max-severity ColdFusion flaw exploited
• Help Net Security — CVE-2026-48282 exploitation detected
• CISA AA23-339A — ColdFusion CVE-2023-26360 (historical precedent, detection TTPs)
• Rapid7 — observed exploitation of Adobe ColdFusion
• Adobe ColdFusion Administrator / Lockdown guidance