Adobe ColdFusion flaw CVE-2026-48282 now exploited in the wild

CVE-2017-3066 is a Java deserialization vulnerability (CWE-502) in the Apache BlazeDS library bundled with Adobe ColdFusion, which handles the product's Flex/AMF remoting functionality. An unauthenticated remote attacker can trigger it by sending crafted serialized Java objects to the server's BlazeDS message broker endpoints over the network. Successful exploitation allows arbitrary code execution with the privileges of the ColdFusion service, and the critical CVSS 3.1 score of 9.8 reflects that no privileges, user interaction, or special conditions are required. Users of Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier are affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-02-24 alongside an Oracle flaw, its EPSS probability of exploitation within 30 days is 90.6% (100th percentile), and a public proof-of-concept exploit is available on Exploit-DB (43993).

Do: Update all ColdFusion 10, 11, and 2016 servers beyond the affected update levels per Adobe's vendor guidance, or discontinue use of the product if mitigations are unavailable, as required by the CISA KEV listing. Until patched, restrict or block network access to the BlazeDS/AMF remoting endpoints (the /flex2gateway endpoints) at the firewall or web server layer, since these are the attack surface for this flaw, and review access logs for anomalous requests to them. A public proof-of-concept (Exploit-DB 43993) shows unauthenticated exploitation, so treat exposed instances as high-priority; ransomware use is currently listed as unknown.

CVE-2026-48282 is a path traversal vulnerability (CWE-22) in Adobe ColdFusion. It is triggered by crafted file-path input containing directory-traversal sequences that the application fails to constrain, allowing access outside the intended directory; per CISA this can escalate to arbitrary code execution in the context of the current user. Successful exploitation could give an attacker the ability to run code on the ColdFusion host under the ColdFusion service account, a common foothold for further network compromise. All organizations running affected Adobe ColdFusion releases, particularly internet-facing instances, are in scope; the specific affected version ranges have not been detailed in the available data. The flaw is already being exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-07 and carries a 42.4% EPSS probability of exploitation within 30 days (99th percentile), though no public PoC is known and ransomware use is unconfirmed.

Do: Inventory all Adobe ColdFusion deployments, prioritizing internet-facing servers, and apply the vendor patch per Adobe's security advisory since the affected version ranges are not yet specified in this data. Federal agencies must patch or apply mitigations in accordance with CISA BOD 26-04 within the KEV deadline or discontinue use if mitigations are unavailable. Until patched, restrict external access to ColdFusion instances and consider WAF/IPS rules blocking directory-traversal sequences in file-path parameters.