CVE-2026-48282 is a critical remote code execution vulnerability in Adobe ColdFusion versions 2025.9, 2023.20, and earlier. It can be exploited remotely by unauthenticated attackers with low complexity to gain code execution on vulnerable systems. Adobe released security updates addressing this flaw one week prior to the advisory, urging administrators to patch within 72 hours. CISA has added this vulnerability to its catalog of actively exploited flaws and issued a Binding Operational Directive requiring U.S. federal civilian agencies to patch by July 10, 2026. The vulnerability is actively exploited in the wild shortly after disclosure. Adobe also patched six other maximum-severity ColdFusion and Campaign Classic flaws, but none are currently known to be exploited. The vulnerability poses a significant risk to exposed ColdFusion instances, with nearly 800 instances tracked online. The directive prioritizes patching due to the potential for automated large-scale exploitation and the ability for attackers to gain partial or total control of affected devices.

Successful exploitation of CVE-2026-48282 allows remote attackers to execute arbitrary code on affected Adobe ColdFusion servers without requiring authentication. This can lead to full compromise of the affected system, enabling attackers to control or disrupt services, access sensitive data, or use the system as a foothold for further attacks. The vulnerability is actively exploited in the wild, increasing the urgency and risk. The flaw affects multiple recent ColdFusion versions widely used in web application development, increasing exposure. The impact is considered maximum severity due to the ease of exploitation and potential for complete system compromise.

Adobe has released official security updates that address CVE-2026-48282 and recommends administrators install these patches immediately, ideally within 72 hours of release. U.S. federal agencies are mandated by CISA's Binding Operational Directive 26-04 to patch affected systems by July 10, 2026. Organizations running affected ColdFusion versions (2025.9, 2023.20, and earlier) should promptly apply the vendor-provided patches to mitigate the risk. No alternative mitigations or workarounds are indicated. Continuous monitoring for updates from Adobe and CISA is advised to ensure systems remain protected.