Attackers exploit max-severity Adobe ColdFusion flaw

Attackers have begun exploiting a maximum-severity vulnerability in Adobe ColdFusion, the Canadian Centre for Cyber Security warned on Thursday, July 2, 2026.

CCCS issues urgent warning on active exploitation. The agency stated that open-source reporting indicates CVE-2026-48282 is being exploited in attacks. It encourages users and administrators to review provided links and apply necessary updates immediately.

The flaw affects ColdFusion versions 2025.9, 2023.20, and earlier. It allows unauthenticated remote code execution on unpatched systems.

Adobe shipped patches two days before the CCCS warning. The company released security updates on Tuesday, June 30, 2026. Adobe described the vulnerability as posing a high risk of exploitation and urged administrators to deploy patches within 72 hours.

"This update resolves vulnerabilities being targeted, or which have a higher risk of being targeted, by exploit(s) in the wild for a given product version and platform," Adobe noted. "Adobe recommends administrators install the update as soon as possible (for example, within 72 hours)."

Shadowserver data shows nearly 800 exposed instances. Internet security watchdog Shadowserver tracks nearly 800 Adobe ColdFusion instances exposed online. There is no information on how many are honeypots or have already been secured against attacks targeting CVE-2026-48282.

Broader Adobe ColdFusion patching activity last week. Last week Adobe released patches for six maximum-severity flaws in ColdFusion and Campaign Classic. All are exploitable via low-complexity attacks without user interaction and carry a high risk of being targeted. The company has not flagged any of them as actively exploited and stated it "is not aware of any exploits in the wild for any of the issues addressed in these updates."

Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency has included 79 Adobe vulnerabilities in its catalog of actively exploited flaws. Ten of those have been abused in ransomware attacks. In early April Adobe issued emergency updates for an Acrobat Reader zero-day exploited since December 2025.