CVE-2026-48282: the max-severity ColdFusion RDS path traversal that became RCE in 48 hours

The flaw lets an attacker abuse ColdFusion's RDS file handler to write a file outside the directory it should be confined to -- and because the file lands in a web-reachable folder as executable CFML, requesting it turns an arbitrary write into remote code execution as the ColdFusion service account (often SYSTEM on Windows). No credentials, no user interaction. The one thing standing between a 10.0 and a shrug is configuration: the unauthenticated path only opens when RDS is enabled and RDS authentication is switched off. RDS is off by default -- but ColdFusion's long history as a ransomware on-ramp means this is still one to close today, not next sprint.

What the flaw actually is

At its core this is a CWE-22 path traversal in the RDS FILEIO handler -- a legacy developer feature, reachable at POST /CFIDE/main/ide.cfm?ACTION=FILEIO, that lets a ColdFusion IDE read and write files on the server over HTTP. According to analyst reconstructions from watchTowr Labs and Resecurity, the handler passes a user-supplied filename into its file-resolution routine without canonicalization, so ../, ..\, absolute paths or null-byte tricks escape the intended RDS working directory and reach anywhere on disk. The patch introduces a canonical-resolution guard that rejects traversal sequences, absolute paths and null bytes before any file operation.

The exploitation chain

From an internet-facing, mis-configured RDS endpoint to a web shell running as SYSTEM. The chain has two hard chokepoints: the patch removes the file-write primitive entirely, and disabling RDS (or setting an RDS password) removes reachability -- either one breaks the whole thing. Detection sits on the FILEIO request itself and on the dropped web shell.

Am I affected?

The bug affects on-prem Adobe ColdFusion 2025 and 2023 -- ColdFusion 2021 is not listed in APSB26-68. Do not trust a patch tracker alone: confirm the actual update level, then confirm whether RDS is exposed. In ColdFusion Administrator, check the Server Information page for the update level and Server Settings for whether Enable RDS Service is on and whether an RDS password is set. Externally, a non-404 response to /CFIDE/main/ide.cfm from an untrusted network means the RDS surface is reachable and must be blocked. Prioritise anything that is internet-facing, RDS-enabled and below the fixed build.

Timeline

Exploited in the wild -- what we do and don't know

The fact of exploitation is solid; the scale is not alarming yet. KEVIntel reported honeypot hits within about two hours of watchTowr's 2 July write-up -- the first observed attempt a file read of a system file (win.ini) from a single India-geolocated IP, the classic vulnerability-confirmation probe. Reporting describes opportunistic, limited activity rather than mass compromise, and Shadowserver's ~750-800 figure is an exposure count, not a compromise count. No named threat actor, cluster or victim sector has been publicly tied to this CVE as of 8 July 2026.

Detection & hunting

A Nuclei template for the vulnerable RDS check was merged on 8 July 2026 (ProjectDiscovery), so run that against your own estate for exposure. For exploitation, two high-value signals -- the FILEIO request in web logs, and the dropped web shell on disk:

• FILEIO requests in web logs: POST to /CFIDE/main/ide.cfm carrying ACTION=FILEIO, especially from external IPs -- RDS should never answer the internet. Quick triage: grep -Ei 'ide\.cfm.*ACTION=FILEIO|\.\./|%2e%2e%2f' access.log.
• Web shells in the web root: new .cfm/.cfc/.cfml/.jsp under the ColdFusion web root or /CFIDE/ (e.g. <cf_root>/cfusion/wwwroot/), with content using <cfexecute>, <cfhttp>, java.lang.Runtime, or Evaluate() on request scopes.
• ColdFusion worker spawning a shell: the coldfusion.exe/java process launching cmd.exe/powershell.exe//bin/sh -- a healthy ColdFusion box essentially never does this. Watch for new scheduled tasks/services and unusual outbound connections too.
• Logs to pull for a hunt: ColdFusion coldfusion-out.log, exception.log, application.log, rdservice.log; plus IIS/Apache/nginx access logs. Confirm paths against your install layout.

# Drafted from Resecurity / watchTowr public analysis -- tune before production.
# Keys on the abuse behaviour (FILEIO handler + traversal), not a single payload.
title: Adobe ColdFusion RDS FILEIO Access / Path Traversal (CVE-2026-48282)
status: experimental
logsource:
  category: webserver
detection:
  selection_rds:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/CFIDE/main/ide.cfm'
      - '/CFIDE/main/websocket.cfm'
    cs-uri-query|contains: 'FILEIO'
  selection_traversal:
    cs-uri-stem|contains: '/CFIDE/'
    c-uri|contains: ['../', '..%2f', '..%5c', '%2e%2e%2f', '..%c0%af']
  condition: selection_rds or selection_traversal
falsepositives:
  - Developers using RDS from ColdFusion Builder over a trusted network (scope out known dev IPs)
level: high

What to do now

1. Patch to ColdFusion 2025 Update 10 or 2023 Update 21 (APSB26-68). It is the fix -- there is no vendor workaround -- and it closes the other 10 bulletin CVEs at the same time. Prioritise internet-facing hosts.
2. If you cannot patch within the deadline: in ColdFusion Administrator disable the RDS Service and set an RDS password, block external access to /CFIDE/administrator, /CFIDE/main/ide.cfm and other /CFIDE/ paths at the WAF/reverse proxy, and run the ColdFusion service as a low-privileged account (not SYSTEM) so a web-shell write is contained.
3. If a host was internet-facing and unpatched since 30 June 2026, assume-compromise: hunt the web root and /CFIDE/ for unauthorized .cfm/.cfc/.jsp, review logs for ACTION=FILEIO and traversal, and check for ColdFusion-process child shells. A found web shell is a full incident, not a cleanup -- rotate secrets reachable from the host.
4. Reduce the surface for next time: keep RDS off in production, segment management planes off the internet, and monitor for any ColdFusion instance answering /CFIDE/main/ide.cfm externally.

FAQ

Sources

• Adobe -- Security bulletin APSB26-68 (ColdFusion)
• NVD -- CVE-2026-48282
• CISA -- Known Exploited Vulnerabilities Catalog
• CISA -- Adds one Known Exploited Vulnerability to Catalog (7 Jul 2026)
• watchTowr Labs -- Adobe ColdFusion APSB26-68 analysis
• Resecurity -- CVE-2026-48282: ColdFusion RDS path traversal leading to RCE
• Help Net Security -- Adobe ColdFusion CVE-2026-48282 exploitation detected
• BleepingComputer -- Max-severity Adobe ColdFusion flaw now exploited in attacks
• SecurityWeek -- Critical Adobe ColdFusion vulnerability exploited in attacks
• Security Affairs -- Adobe ColdFusion flaw CVE-2026-48282 now exploited in the wild
• CCB Belgium -- Adobe patches 11 ColdFusion flaws (APSB26-68)
• Qualys ThreatPROTECT -- Adobe releases patches for ColdFusion critical vulnerabilities
• ProjectDiscovery -- Nuclei template for CVE-2026-48282 (PR #16538)
• GreyNoise Labs -- Coordinated ColdFusion scanning campaign (Dec 2025, historical context)
• CISA AA23-339A -- Threat actors exploit ColdFusion CVE-2023-26360 (historical context)