Which SIEM platforms have a CVE-2026-48282 detection rule?

df00tech provides CVE-2026-48282 (CVE-2026-48282: Adobe ColdFusion Path Traversal Exploitation) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect CVE-2026-48282: Adobe ColdFusion Path Traversal Exploitation (CVE-2026-48282)?

Detecting CVE-2026-48282: Adobe ColdFusion Path Traversal Exploitation requires the following data sources: IIS Web Logs, Azure Diagnostics, Microsoft Sentinel W3CIISLog.

What severity and confidence is the CVE-2026-48282 detection?

The CVE-2026-48282 detection is rated critical severity with high confidence.

What are common false positives for CVE-2026-48282?

Common false positives for CVE-2026-48282 include: Legitimate URL-encoded paths in complex REST API calls that coincidentally contain encoded dots; Web application vulnerability scanners (Burp Suite, Nessus, Qualys) running authorized assessments; CDN or reverse proxy health checks that encode special characters in forwarded URIs.

CVE-2026-48282: CVE-2026-48282: Adobe ColdFusion Path Traversal Exploitation — Detection (KQL, SPL, Sigma + 5 SIEMs)

Microsoft Sentinel / Defender

kusto

union W3CIISLog, AzureDiagnostics
| where TimeGenerated >= ago(24h)
| where csUriStem has_any ("../", "..%2f", "..%2F", "%2e%2e", "..%5c", "..%5C", ".%2e/", "%2e./")
    or csUriQuery has_any ("../", "..%2f", "..%2F", "%2e%2e", "..%5c", "..%5C")
    or csUriStem matches regex @"(\.\./|%2[eE]%2[eE]|%252[eE]%252[eE])"
| where csUriStem has_any (".cfm", ".cfc", "/CFIDE/", "/cfide/", "/cf_scripts/")
    or csUriStem has_any ("/administrator/", "/rest/", "/flex2gateway/")
| extend TraversalDepth = array_length(extract_all(@"(\.\./|%2[eE]%2[eE]/)", strcat(csUriStem, csUriQuery)))
| extend TargetedFile = extract(@"([\w.-]+\.(xml|properties|ini|pwd|pfx|p12|key|pem|cfm|cfc|log))$", 0, csUriStem)
| extend AttackerIP = iff(isnotempty(cIP), cIP, CallerIpAddress)
| where TraversalDepth >= 1 or isnotempty(TargetedFile)
| summarize
    RequestCount = count(),
    UniqueURIs = dcount(csUriStem),
    UniqueTargets = make_set(TargetedFile, 20),
    StatusCodes = make_set(scStatus, 10),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by AttackerIP, csHost, bin(TimeGenerated, 5m)
| where RequestCount >= 1
| extend SuccessfulTraversal = set_has_element(StatusCodes, "200")
| project-reorder LastSeen, AttackerIP, csHost, RequestCount, UniqueURIs, UniqueTargets, SuccessfulTraversal, StatusCodes

Detects HTTP requests to Adobe ColdFusion endpoints containing path traversal sequences in URI stem or query parameters. Summarizes traversal attempts by source IP and tracks whether any returned HTTP 200 (successful read).

critical severity high confidence

Data Sources

IIS Web Logs Azure Diagnostics Microsoft Sentinel W3CIISLog

Required Tables

W3CIISLog AzureDiagnostics

False Positives

Legitimate URL-encoded paths in complex REST API calls that coincidentally contain encoded dots
Web application vulnerability scanners (Burp Suite, Nessus, Qualys) running authorized assessments
CDN or reverse proxy health checks that encode special characters in forwarded URIs
Legacy ColdFusion applications that use relative paths in cfinclude tags surfacing in request logs

Splunk

spl

index=web sourcetype IN (iis, apache_access, nginx_access) 
    (uri_path="*../*" OR uri_path="*..%2f*" OR uri_path="*..%2F*" OR uri_path="*%2e%2e%2f*" OR uri_path="*%252e%252e*" OR uri_query="*../*" OR uri_query="*..%2f*")
    (uri_path="*.cfm*" OR uri_path="*.cfc*" OR uri_path="*/CFIDE/*" OR uri_path="*/cfide/*" OR uri_path="*/cf_scripts/*" OR uri_path="*/rest/*")
| eval traversal_depth=mvcount(split(uri_path,"../"))-1
| eval uri_combined=coalesce(uri_path,"") . coalesce(uri_query,"")
| rex field=uri_combined max_match=5 "(?i)(\.\./|%2e%2e[/%5c]|%252e%252e)" AS traversal_sequences
| eval targeted_sensitive=if(match(uri_combined, "(?i)(password|passwd|secret|credential|config\.xml|neo-security\.xml|password\.properties|server\.xml|web\.xml|\.pfx|\.pem|\.key)"), 1, 0)
| stats 
    count AS request_count,
    dc(uri_path) AS unique_uris,
    values(status) AS http_statuses,
    max(targeted_sensitive) AS hit_sensitive_file,
    min(_time) AS first_seen,
    max(_time) AS last_seen,
    values(uri_path) AS traversal_uris
    BY src_ip, host, sourcetype
| where request_count >= 1
| eval successful=(if(mvfind(http_statuses,"200")>=0, "YES", "NO"))
| eval severity=case(
    hit_sensitive_file=1 AND successful="YES", "CRITICAL",
    successful="YES", "HIGH",
    hit_sensitive_file=1, "HIGH",
    true(), "MEDIUM")
| sort -severity, -request_count
| table last_seen, src_ip, host, request_count, unique_uris, successful, hit_sensitive_file, severity, traversal_uris, http_statuses

Splunk search detecting Adobe ColdFusion path traversal attempts across IIS, Apache, and Nginx access logs. Flags requests with traversal sequences targeting ColdFusion endpoints and escalates severity when sensitive configuration files are targeted and HTTP 200 responses observed.

critical severity high confidence

Data Sources

IIS Access Logs Apache Access Logs Nginx Access Logs Splunk Stream HTTP

Required Sourcetypes

iis apache_access nginx_access stream:http

False Positives

Authorized penetration testing or red team engagements against ColdFusion infrastructure
Web application firewalls or IDS/IPS systems that log decoded traversal sequences during inspection
Poorly coded ColdFusion applications that pass relative paths through URL parameters for template includes
Monitoring or synthetic transaction tools that generate parameterized requests with dot-encoded paths

Elastic Security (EQL)

eql

sequence by source.ip with maxspan=10m
  [network where event.dataset in ("iis.access", "apache.access", "nginx.access")
   and (
     url.path : ("*../*", "*..%2f*", "*..%2F*", "*%2e%2e*", "*%252e%252e*", "*..%5c*", "*..%5C*")
     or url.query : ("*../*", "*..%2f*", "*..%2F*", "*%2e%2e*")
   )
   and (
     url.path : ("*.cfm*", "*.cfc*", "*/CFIDE/*", "*/cfide/*", "*/cf_scripts/*", "*/rest/*", "*/flex2gateway/*")
   )
  ] with runs=1

Elastic EQL sequence query detecting single or repeated path traversal attempts against Adobe ColdFusion endpoints. Correlates events from the same source IP within a 10-minute window. Covers both URL-encoded and double-encoded traversal sequences.

critical severity high confidence

Data Sources

Elastic SIEM IIS Access Logs Apache Access Logs Nginx Access Logs Packetbeat HTTP

Required Tables

logs-* filebeat-*

False Positives

Authorized vulnerability scanners (Tenable, Rapid7) configured to test ColdFusion targets
CI/CD pipelines running DAST tools such as OWASP ZAP against staging ColdFusion environments
Browser extensions or proxies that encode URLs before forwarding, producing double-encoded sequences
Legacy ColdFusion applications with non-standard URL routing that legitimately use encoded dot sequences

IBM QRadar (AQL)

sql

SELECT
    sourceip,
    "destinationIP",
    URL,
    "HTTPResponseCode",
    starttime,
    LOWER(URL) AS url_lower,
    CASE
        WHEN URL MATCHES '.*(\.\./|%2e%2e|%252e%252e|%2f%2e%2e|%5c%2e%2e).*' THEN TRUE
        ELSE FALSE
    END AS has_traversal,
    CASE
        WHEN LOWER(URL) MATCHES '.*(password|secret|credential|config\.xml|neo-security|neo-runtime|server\.xml|\.pfx|\.pem|\.key).*' THEN TRUE
        ELSE FALSE
    END AS targets_sensitive
FROM events
WHERE
    LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Apache HTTP Server', 'nginx')
    AND (
        URL MATCHES '.*(\.\./|%2e%2e%2f|%2e%2e%5c|%252e%252e|%2f%2e%2e%2f).*'
        OR LOWER(URL) MATCHES '.*(\.\./).*'
    )
    AND (
        LOWER(URL) MATCHES '.*(\.cfm|\.cfc|/cfide/|/cf_scripts/|/rest/|/flex2gateway/).*'
    )
    AND LOGSOURCETIME BETWEEN (NOW() - 3600000) AND NOW()
ORDER BY starttime DESC
LIMIT 500

QRadar AQL query identifying path traversal sequences in HTTP requests directed at Adobe ColdFusion endpoints. Flags requests targeting sensitive file patterns and orders results by recency for triage.

critical severity medium confidence

Data Sources

QRadar Log Source - IIS QRadar Log Source - Apache QRadar Log Source - nginx QRadar Network Activity

Required Tables

events

False Positives

Authorized web application security scans logged through QRadar-connected IDS sensors
Proxy or load balancer re-encoding of URI components that introduces traversal-like sequences
ColdFusion application health check endpoints that use parameterized paths with dot components
Third-party monitoring agents that test ColdFusion availability with encoded path parameters

Sumo Logic CSE

sql

_sourceCategory=web/access/coldfusion OR _sourceCategory=web/iis OR _sourceCategory=web/apache
| where (%"cs-uri-stem" matches "*../*" or %"cs-uri-stem" matches "*..%2f*" or %"cs-uri-stem" matches "*%2e%2e*" or %"cs-uri-stem" matches "*%252e*"
    or %"request" matches "*../*" or %"request" matches "*..%2f*" or %"request" matches "*%2e%2e*")
| where (%"cs-uri-stem" matches "*.cfm*" or %"cs-uri-stem" matches "*.cfc*" or %"cs-uri-stem" matches "*/CFIDE/*" or %"cs-uri-stem" matches "*/rest/*"
    or %"request" matches "*.cfm*" or %"request" matches "*.cfc*" or %"request" matches "*/CFIDE/*")
| parse regex field=%"cs-uri-stem" "(?<traversal_seq>(?:\.\.[\/]|%2[eE]%2[eE][\/]|%252[eE]%252[eE])+)" nodrop
| if (isEmpty(traversal_seq), "none", traversal_seq) as traversal_seq
| parse regex field=%"cs-uri-stem" "(?i)(?<target_file>[\w.-]+\.(?:xml|properties|ini|pwd|pfx|p12|key|pem|log|cfm|cfc))$" nodrop
| count as request_count, values(%"sc-status") as http_codes, values(%"cs-uri-stem") as traversal_uris by %"c-ip", %"cs-host"
| where request_count >= 1
| sort by request_count desc

Sumo Logic query detecting ColdFusion path traversal attempts from web access logs. Parses traversal sequences and targeted filenames, aggregating by source IP and host for triage prioritization.

critical severity medium confidence

Data Sources

Sumo Logic HTTP Collector - IIS Sumo Logic HTTP Collector - Apache Sumo Logic Cloud SIEM

Required Tables

_sourceCategory=web/access/* _sourceCategory=web/iis _sourceCategory=web/apache

False Positives

Internal vulnerability management platforms scanning ColdFusion servers on a scheduled basis
Multi-tenant hosting environments where encoded path characters appear in subdirectory routing
ColdFusion application search functions that pass URL-encoded relative paths as parameters
WAF bypass testing by internal security teams generating encoded traversal payloads in non-production

Google Chronicle / SecOps

yaral

rule cve_2026_48282_coldfusion_path_traversal {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-48282 Adobe ColdFusion path traversal exploitation attempts"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($req.network.http.request_url, `(?i)(\.\./|%2[eE]%2[eE][/%5c]|%252[eE]%252[eE]|%2[fF]%2[eE]%2[eE]%2[fF])`)
      or
      re.regex($req.network.http.request_url, `(?i)(\.%2[eE]/|%2[eE]%2[eE]%5[cC])`)
    )
    (
      re.regex($req.network.http.request_url, `(?i)(\.cfm|\.cfc|/[Cc][Ff][Ii][Dd][Ee]/|/cf_scripts/|/rest/|/flex2gateway/)`)
    )
    $req.principal.ip = $ip
    $req.network.http.response_code >= 0

  match:
    $ip over 10m

  outcome:
    $risk_score = max(
      if($req.network.http.response_code = 200, 95, 70)
    )
    $traversal_url = array_distinct($req.network.http.request_url)
    $response_codes = array_distinct($req.network.http.response_code)
    $target_host = array_distinct($req.target.hostname)

  condition:
    #req >= 1
}

Chronicle YARA-L 2.0 rule detecting Adobe ColdFusion path traversal exploitation matching CVE-2026-48282. Triggers on HTTP requests containing traversal sequences directed at ColdFusion endpoints, with risk score elevated for HTTP 200 responses indicating successful traversal.

critical severity high confidence

Data Sources

Chronicle SIEM HTTP Events Google Cloud Armor Logs Chronicle UDM Network Events

Required Tables

chronicle_udm_events

False Positives

Chronicle ingesting WAF or IDS logs that decode and re-log traversal sequences during normalization
Third-party SaaS integration callbacks to ColdFusion APIs that use URL-encoded dot segments
Google Cloud Load Balancer access logs where path encoding varies across log pipeline stages
Automated uptime monitors testing ColdFusion REST endpoints with parameterized encoded paths

CrowdStrike LogScale (CQL)

cql

#event_simpleName=NetworkReceiveAcceptIP4 OR #event_simpleName=NetworkReceiveAcceptIP6
| TargetPort in (80, 443, 8500, 8300, 8400)
| LocalAddressIP4 != "127.0.0.1"
| join
    {
        #event_simpleName=ProcessRollup2
        | ImageFileName matches "(?i)(coldfusion|jrun|cf|w3wp|httpd|nginx)(\.exe)?$"
        | CommandLine != null
    }
    field=[aid, ContextProcessId]
    kind=inner
| ImageFileName matches "(?i)(coldfusion|jrun|cf|w3wp|httpd|nginx)(\.exe)?$"
| (CommandLine matches "(?i)(\.\./|\.\.\\ |\.%2[eE])" OR ImageFileName matches "(?i)(cfusion|coldfusion)")
| groupBy([aid, RemoteAddressIP4, LocalPort, ImageFileName, CommandLine], function=([count(aid, as=connection_count), min(timestamp, as=first_seen), max(timestamp, as=last_seen)]))
| sort connection_count desc

CrowdStrike Falcon CQL query correlating network receive events on common ColdFusion ports with ColdFusion process activity. Surfaces ColdFusion processes receiving inbound connections that may correspond to path traversal exploitation, enabling host-level context for web log findings.

high severity medium confidence

Data Sources

CrowdStrike Falcon EDR CrowdStrike Falcon Network Events Falcon Process Telemetry

Required Tables

NetworkReceiveAcceptIP4 NetworkReceiveAcceptIP6 ProcessRollup2

False Positives

Legitimate administrative connections to ColdFusion Administrator interface on port 8500
ColdFusion scheduled tasks initiating outbound connections that appear as process-network correlations
Health check systems polling ColdFusion service ports generating high connection counts
Internal application servers making API calls to ColdFusion REST endpoints on non-standard ports

Vulnerability Intelligence

CVE

Affected Software

Weakness (CWE)

Timeline

References & Proof of Concept

CVSS

What is CVE-2026-48282 CVE-2026-48282: Adobe ColdFusion Path Traversal Exploitation?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for CVE-2026-48282

Testing Methodology

Unlock Pro Content

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox