Adobe ColdFusion carries an unauthenticated path-traversal flaw in its Remote Development Services (RDS) FILEIO handler that converts arbitrary file write into remote code execution. Adobe rated it Priority 1, CISA added it to the KEV catalog on 2026-07-07, and honeypot sensors recorded exploitation attempts within about two hours of the first public technical write-up. If you run an internet-facing ColdFusion server, treat this as an active incident, not a scheduled patch.
Am I vulnerable?
Affected versions
| Product |
Vulnerable range |
Fixed in |
| Adobe ColdFusion 2025 |
Update 9 (2025.9) and earlier |
Update 10 (2025.10) — APSB26-68 |
| Adobe ColdFusion 2023 |
Update 20 (2023.20) and earlier |
Update 21 (2023.21) — APSB26-68 |
Exploitation requires the RDS endpoint to be reachable and RDS authentication to be disabled. RDS is off by default in production, so a hardened install is not exposed unauthenticated — but development-style deployments and images that shipped with RDS enabled and no RDS password are directly in the blast zone. Confirm three things: the build number, whether RDS answers, and whether RDS auth is set.
- Confirm the build (read-only file):
type "C:\ColdFusion2025\cfusion\lib\version.properties" on Windows, or cat /opt/coldfusion2025/cfusion/lib/version.properties on Linux. Vulnerable if it maps to Update 9 / 2025.9 or lower (or Update 20 / 2023.20 or lower). Cross-check against ColdFusion Administrator → System Information.
- Fingerprint the RDS endpoint (read-only HEAD):
curl -sI -k https://<cf-host>:8500/CFIDE/main/ide.cfm (also test :443 / :8501). A 200/302 means the RDS ide.cfm endpoint is reachable; a 404 or block suggests RDS/CFIDE is not exposed.
- Check RDS state and auth: in ColdFusion Administrator → Security → RDS, confirm whether "Enable RDS" is on and whether an RDS password/authentication is set. RDS enabled with authentication disabled is the exploitable configuration.
- Hunt for prior exploitation (read-only): search the web root and
/CFIDE/ for recently-created .cfm/.cfc/.cfml/.jsp files, and grep access logs for POSTs to /CFIDE/main/ide.cfm?ACTION=FILEIO and for ../ / ..\ sequences in request bodies.
Vulnerability
This is a classic CWE-22 Improper Limitation of a Pathname ('Path Traversal'). Per watchTowr's patch-diff analysis, the RDS FileWriteOperator previously passed a user-supplied filename straight to FileServlet.getFile() with no canonicalization or directory-boundary check; the patch inserts a canonicalizing resolver (RdsFileSecurity.resolveCanonical() / getCanonicalFile()) that rejects ../ and absolute paths. The reachable surface is the RDS RPC FILEIO handler at /CFIDE/main/ide.cfm, which accepts file operations over the network.
NVD scores the flaw CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — network-reachable, no authentication, no user interaction, and a scope change reflecting that code executes in the ColdFusion service context rather than being confined to the application. The operational primitive is unauthenticated arbitrary file write: an attacker plants a CFML template (a webshell) inside the web root, then requests it, and the ColdFusion process executes it. Resecurity notes the same handler also permits arbitrary file read — a non-destructive FILEIO read of C:\Windows\win.ini returns file contents on a vulnerable server, which doubles as a benign proof of exposure.
Threat model
Who would exploit this: The vector — unauthenticated, network-reachable arbitrary file write yielding RCE — suits opportunistic mass-scanning operators who spray the internet for exposed ColdFusion Administrators, and that is what happened: exploitation began within roughly two hours of public disclosure. ColdFusion's install base skews toward government, education, and legacy enterprise apps, drawing two overlapping categories — financially motivated crews (initial-access brokers and ransomware affiliates) and state-aligned actors seeking public-sector footholds. Both have a documented history against this exact product; no named actor is attributed to CVE-2026-48282 itself.
What they're after:
- Foothold / initial access — a CFML webshell in the web root for durable unauthenticated command execution
- Persistence — planted webshells, scheduled tasks, or new service accounts on the host
- Data exfiltration — application databases via harvested datasource credentials, plus files on the server
- Lateral movement — pivot from an internet-facing server into internal segments
- Fraud / extortion — ransomware staging or sale of access by initial-access brokers
Attack chain: The attacker sends a crafted RDS RPC request whose FILEIO path carries directory-traversal sequences that the handler forwards to the filesystem without canonicalization. That writes an arbitrary file — typically a CFML webshell — into the web root. Requesting the planted file executes it in the ColdFusion process context, converting arbitrary file write into remote code execution, after which the operator runs commands, enumerates the host, and establishes persistence.
Blast radius: A compromised ColdFusion server runs code in the application-server service context — commonly a high-privilege account on Windows/IIS or the app-server user on Linux/Apache — and exposes the datasource credentials stored in ColdFusion Administrator, which unlock the backend application databases. That yields the served application's data, files on the host, and a foothold on a machine that is usually internet-facing yet trusted inside the perimeter. Prior ColdFusion CVEs have been used exactly this way: CVE-2023-26360 was exploited against a U.S. federal (FCEB) agency's public-facing servers (CISA AA23-339A). CISA's KEV listing confirms CVE-2026-48282 is under active exploitation.
Mitigation
Patch
Update on the KEV clock — CISA's due date was 2026-07-10.
| Product |
Update to |
| Adobe ColdFusion 2025 |
Update 10 (2025.10) |
| Adobe ColdFusion 2023 |
Update 21 (2023.21) |
Configuration mitigation
If you cannot patch immediately, remove the exploitation prerequisite: disable RDS in production, or ensure RDS authentication is enabled so the FILEIO handler is not reachable unauthenticated. Per the ColdFusion Lockdown Guide, the RDS servlet mapping can be removed from the instance web.xml:
Comment out / remove the RDS servlet mapping in {cf_instance}/WEB-INF/web.xml:
<!-- Comment out / remove the RDSServlet mapping to disable the RDS endpoint
<servlet-mapping>
<servlet-name>RDSServlet</servlet-name>
<url-pattern>/CFIDE/main/ide.cfm</url-pattern>
</servlet-mapping>
-->
This is a stopgap, not a substitute for the update.
Compensating controls
- Restrict network access to the ColdFusion Administrator and
/CFIDE/ — these should never be internet-reachable; front them with an allowlist or VPN.
- Deploy WAF rules that inspect for and block directory-traversal sequences (
../ and its encoded variants) in requests to ColdFusion handlers, especially POSTs to /CFIDE/main/ide.cfm.
- Run ColdFusion under a least-privilege service account so a webshell inherits the smallest possible privilege set, and segment the server away from internal crown-jewel systems.
- Rotate any datasource credentials that were reachable if you find evidence of compromise.
Detection (starter rules — validate before deploying)
These rules are AI-generated starter content. Test against your own telemetry and tune falsepositives before deploying to production.
Network and log signals
- Directory-traversal-encoded URIs in IIS (
u_ex*.log) or Apache/NGINX access logs targeting ColdFusion handlers (/CFIDE/, *.cfm, *.cfc, /flex2gateway/, /rest/, /cf_scripts/) — watch for ../, ..\, %2e%2e%2f, ..%2f, %2e%2e%5c, ..%c0%af, ..%c1%9c, and double-encoded %252e%252e.
- POSTs to
/CFIDE/main/ide.cfm?ACTION=FILEIO carrying binary RPC payloads, especially from unauthenticated sources with no prior session.
coldfusion.exe or the ColdFusion JVM (java.exe) spawning shell/LOLBin children: cmd.exe, powershell.exe, cscript.exe, bitsadmin.exe, certutil.exe, curl.exe, whoami.exe, net.exe.- New or modified
.cfm/.cfc/.jsp files written under the web root (wwwroot, CFIDE, cf_scripts, virtual-directory roots) outside deploy windows — especially small files using <cfexecute>, Runtime.exec, or CreateObject("java", ...).
- Outbound connections initiated by the ColdFusion JVM shortly after a traversal-pattern request (possible reverse shell / stager download) — correlate access-log timestamp with process/network telemetry.
- ColdFusion application/exception logs (
coldfusion-out.log, exception.log) showing file-access errors with .. path fragments, or template execution from temp/upload directories.
YARA
rule CVE_2026_48282_ColdFusion_Traversal_Webshell_starter
{
meta:
description = "AI-generated starter rule - detects CFML/JSP webshell-style artifacts consistent with post-exploitation of Adobe ColdFusion path traversal to RCE (CVE-2026-48282). Validate in your environment before deploying."
author = "CVE Brief - Detection Engineering (AI-generated starter)"
reference = "CVE-2026-48282"
date = "2026-07-08"
confidence = "medium"
note = "Behavioral/heuristic - no verified sample hashes. Tune before production."
strings:
// CFML command execution primitives
$cf_exec1 = "<cfexecute" nocase
$cf_exec2 = "cfexecute" nocase
$cf_java1 = "createObject(\"java\"" nocase
$cf_java2 = "java.lang.Runtime" nocase
$cf_java3 = "getRuntime().exec" nocase
$cf_proc = "java.lang.ProcessBuilder" nocase
// Common webshell param-driven exec patterns
$shell1 = "cmd.exe /c" nocase
$shell2 = "/bin/sh" nocase
$shell3 = "powershell" nocase
// CFML dynamic eval / file write helpers often seen in shells
$cf_eval1 = "<cfoutput" nocase
$cf_file1 = "<cffile" nocase
$cf_url = "URL." nocase
$cf_form = "FORM." nocase
// Traversal encodings if artifact embeds the request/log line
$trav1 = "..%c0%af" nocase
$trav2 = "%2e%2e%2f" nocase
$trav3 = "..%252f" nocase
condition:
// CFML file that combines an exec primitive with request-controlled input
(
(any of ($cf_exec1, $cf_exec2, $cf_java3, $cf_proc)) and
(any of ($cf_url, $cf_form)) and
(any of ($shell1, $shell2, $shell3, $cf_java1, $cf_java2))
)
or
// small dropped CFML writer/shell using cffile + dynamic input
(
filesize < 30KB and
$cf_file1 and (any of ($cf_url, $cf_form)) and (any of ($shell1, $shell2, $shell3, $cf_exec1, $cf_exec2))
)
or
// artifact that captured the traversal request alongside exec strings
(
(any of ($trav1, $trav2, $trav3)) and (any of ($cf_exec1, $cf_exec2, $cf_java3, $shell1, $shell2, $shell3))
)
}
Sigma
title: Adobe ColdFusion Path Traversal Exploitation and Post-Exploit Behavior (CVE-2026-48282)
id: 6f3c9d84-2a71-4e15-9b0e-482820c1df01
status: experimental
description: >
AI-generated starter rule. Detects directory-traversal-encoded HTTP requests targeting Adobe ColdFusion
handlers (unauthenticated path traversal to RCE, CVE-2026-48282) in web server access logs. Validate in your
environment before deploying.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-48282
author: CVE Brief - Detection Engineering (AI-generated starter)
date: 2026/07/08
tags:
- attack.initial_access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: webserver
detection:
cf_endpoint:
cs-uri-stem|contains:
- '/CFIDE/'
- '/cf_scripts/'
- '/flex2gateway'
- '/rest/'
- '.cfm'
- '.cfc'
traversal_encoding:
cs-uri-stem|contains:
- '../'
- '..\'
- '%2e%2e%2f'
- '%2e%2e/'
- '..%2f'
- '%2e%2e%5c'
- '..%5c'
- '..%c0%af'
- '..%c1%9c'
- '%252e%252e'
traversal_in_query:
cs-uri-query|contains:
- '../'
- '%2e%2e%2f'
- '..%2f'
- '..%c0%af'
- '%252e%252e'
condition: cf_endpoint and (traversal_encoding or traversal_in_query)
falsepositives:
- Vulnerability scanners, DAST tools, or authorized penetration tests probing ColdFusion endpoints
- Legacy applications that legitimately pass path-like values in query strings
- WAF/security appliances replaying encoded payloads for testing
- URL-rewrite or CDN normalization that reintroduces encoded sequences into logged URIs
level: high
Rule notes
The Sigma rule keys on ColdFusion handler URIs combined with traversal encodings in access logs — the highest-signal starting point for this unauthenticated-traversal-to-RCE bug. The YARA rule is a behavioral webshell/artifact heuristic for post-exploit CFML/JSP drops, since no verified sample hashes exist. Both are generic starters: the encoding lists are non-exhaustive and log field names (IIS cs-uri-stem vs Apache) will need mapping, so expect tuning, and pair the access-log detection with the process-spawn signals above for confirmation.
References