Adobe ColdFusion Critical Patch: 6 CVSS 10.0 RCE Flaws Disclosed

Adobe has released urgent security patches for ColdFusion, resolving multiple critical vulnerabilities including six rated at the maximum CVSS score of 10.0. These flaws enable unauthenticated remote code execution on widely deployed ColdFusion servers. Adobe assigned its highest priority deployment rating and recommended patching within 72 hours.

What Happened: Adobe ColdFusion Critical Patch Batch Discloses 6 CVSS 10.0 Flaws

On July 1, 2026, Adobe published security updates for ColdFusion 2023 and ColdFusion 2025. The update resolves critical and important vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass.

ColdFusion has a grim exploitation history. Sixteen ColdFusion CVEs already sit in the CISA Known Exploited Vulnerabilities catalog. Consequently, defenders should treat this patch cycle with exceptional urgency.

Technical Details of the ColdFusion Vulnerabilities

The disclosed vulnerabilities fall into two severity tiers. Six flaws carry a CVSS 10.0 score, while two additional critical flaws score 9.3. All enable significant attacker capabilities on affected systems.

CVSS 10.0 Unauthenticated RCE Flaws

1. CVE-2026-48276 — Unrestricted upload of file with dangerous type. An attacker can upload a malicious file to execute arbitrary code on the server.
2. CVE-2026-48283 — Unrestricted upload of file with dangerous type. Same impact as CVE-2026-48276.
3. CVE-2026-48277 — Improper input validation. Remote attackers can pass malicious input to trigger arbitrary code execution.
4. CVE-2026-48281 — Improper input validation. Same attack vector as CVE-2026-48277.
5. CVE-2026-48316 — Improper input validation. Enables unauthenticated remote code execution.
6. CVE-2026-48282 — Path traversal. An attacker can traverse the file system to execute arbitrary code.

CVSS 9.3 Critical Flaws

1. CVE-2026-48313 — Path traversal leading to arbitrary file system read. Attackers can read sensitive files from the host.
2. CVE-2026-48315 — Improper input validation leading to privilege escalation. An authenticated attacker can elevate privileges on the system.

Affected Versions and Attack Vectors

• Affected products: Adobe ColdFusion 2023 and Adobe ColdFusion 2025
• Attack vector: Network-based, unauthenticated for the CVSS 10.0 flaws
• Privileges required: None for the RCE flaws; low for the privilege escalation flaw
• User interaction: None required
• Patch availability: ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10

Business and Operational Impact

ColdFusion is a widely deployed web application development platform used in government, financial services, healthcare, and enterprise environments. Unauthenticated remote code execution on these servers poses severe operational risk.

• Data exposure: Attackers can read, modify, or exfiltrate application data and backend databases.
• Lateral movement: Compromised ColdFusion servers often hold elevated privileges, enabling pivoting across the network.
• Ransomware deployment: Historical ColdFusion exploitation has preceded ransomware incidents.
• Compliance risk: Unpatched critical vulnerabilities can trigger regulatory scrutiny and breach notification obligations.
• Reputation damage: Public-facing applications running on vulnerable ColdFusion instances face immediate defacement or data leak risks.

Mitigation and Recommendations

Adobe assigned its highest priority deployment rating to these updates. Organizations should apply patches immediately.

Immediate Actions for Defenders

1. Apply ColdFusion 2023 Update 21 or ColdFusion 2025 Update 10 as soon as possible.
2. Verify that all ColdFusion instances are covered by the update, including development and staging environments.
3. Review web access logs for unusual file uploads, path traversal attempts, or unexpected input validation errors.
4. Segment ColdFusion servers from internal networks where feasible to limit lateral movement.
5. Enable application-level monitoring for suspicious process execution on ColdFusion hosts.

Detection Guidance

Security teams should monitor for:

• Unexpected file uploads to ColdFusion web directories
• Directory traversal strings in HTTP requests (e.g., ../ sequences)
• Anomalous child processes spawned by the ColdFusion service
• Outbound network connections from ColdFusion servers to unexpected destinations

Bottom line: Six unauthenticated remote code execution flaws with a CVSS 10.0 score on a historically exploited platform demand immediate patching. Treat this as a highest-priority security event and validate patch coverage across all ColdFusion instances within 72 hours.

Incident Summary

CVE ID / Incident:	Adobe ColdFusion Critical Patch Batch (CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48282, CVE-2026-48283, CVE-2026-48313, CVE-2026-48315, CVE-2026-48316)
Affected Systems:	Adobe ColdFusion 2023 and 2025
Disclosure Date:	July 1, 2026
Patch Status:	Available — ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10

References

1. Adobe Security Bulletin APSB26-68, “Adobe ColdFusion Security Update,” July 1, 2026, https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html, accessed July 2, 2026.
2. The Hacker News, “Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic,” July 1, 2026, https://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.html, accessed July 2, 2026.
3. CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog, accessed July 2, 2026.
4. Threat Modeling, “Vulnerability Intelligence Report — July 1, 2026,” July 1, 2026, https://threat-modeling.com/vulnerability-intelligence-report-july-1-2026/, accessed July 2, 2026.