Detect CVE-2026-48282: Adobe ColdFusion Path Traversal Exploitation in Microsoft Sentinel
Detects exploitation attempts targeting CVE-2026-48282, a path traversal vulnerability (CWE-22) in Adobe ColdFusion. Active exploitation confirmed by CISA KEV listing. Attackers may use directory traversal sequences in HTTP requests to read sensitive files outside the web root, including configuration files containing credentials, or to achieve remote code execution via file write primitives.
MITRE ATT&CK
KQL Detection Query
union W3CIISLog, AzureDiagnostics
| where TimeGenerated >= ago(24h)
| where csUriStem has_any ("../", "..%2f", "..%2F", "%2e%2e", "..%5c", "..%5C", ".%2e/", "%2e./")
or csUriQuery has_any ("../", "..%2f", "..%2F", "%2e%2e", "..%5c", "..%5C")
or csUriStem matches regex @"(\.\./|%2[eE]%2[eE]|%252[eE]%252[eE])"
| where csUriStem has_any (".cfm", ".cfc", "/CFIDE/", "/cfide/", "/cf_scripts/")
or csUriStem has_any ("/administrator/", "/rest/", "/flex2gateway/")
| extend TraversalDepth = array_length(extract_all(@"(\.\./|%2[eE]%2[eE]/)", strcat(csUriStem, csUriQuery)))
| extend TargetedFile = extract(@"([\w.-]+\.(xml|properties|ini|pwd|pfx|p12|key|pem|cfm|cfc|log))$", 0, csUriStem)
| extend AttackerIP = iff(isnotempty(cIP), cIP, CallerIpAddress)
| where TraversalDepth >= 1 or isnotempty(TargetedFile)
| summarize
RequestCount = count(),
UniqueURIs = dcount(csUriStem),
UniqueTargets = make_set(TargetedFile, 20),
StatusCodes = make_set(scStatus, 10),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by AttackerIP, csHost, bin(TimeGenerated, 5m)
| where RequestCount >= 1
| extend SuccessfulTraversal = set_has_element(StatusCodes, "200")
| project-reorder LastSeen, AttackerIP, csHost, RequestCount, UniqueURIs, UniqueTargets, SuccessfulTraversal, StatusCodesDetects HTTP requests to Adobe ColdFusion endpoints containing path traversal sequences in URI stem or query parameters. Summarizes traversal attempts by source IP and tracks whether any returned HTTP 200 (successful read).
Data Sources
Required Tables
False Positives & Tuning
- Legitimate URL-encoded paths in complex REST API calls that coincidentally contain encoded dots
- Web application vulnerability scanners (Burp Suite, Nessus, Qualys) running authorized assessments
- CDN or reverse proxy health checks that encode special characters in forwarded URIs
- Legacy ColdFusion applications that use relative paths in cfinclude tags surfacing in request logs
Other platforms for CVE-2026-48282
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1ColdFusion Path Traversal - Read neo-security.xml via URL traversal
Expected signal: IIS/Apache access log entry: GET /CFIDE/administrator/../../lib/neo-security.xml with source IP of test host. HTTP response code 200 if vulnerable, 400/403 if patched or WAF-blocked.
- Test 2ColdFusion Path Traversal - URL-encoded traversal to password.properties
Expected signal: Web server access log entry with URL-encoded traversal sequence. If server decodes before logging, DecodedURI will contain '../lib/password.properties'. If logged raw, csUriStem will contain '%2e%2e%2f%2e%2e%2f'.
- Test 3ColdFusion Path Traversal - Double-encoded traversal sequence (%252e%252e)
Expected signal: WAF logs should show the double-encoded payload. ColdFusion access logs may show decoded single-percent-encoded form if WAF decodes once before forwarding. Both log sources should be checked.
- Test 4ColdFusion Path Traversal - Enumerate ColdFusion web root via automated scan simulation
Expected signal: Multiple web server access log entries from the same source IP within a short window, each containing traversal sequences targeting different ColdFusion configuration file paths. HTTP response sizes will differ based on file accessibility.
References (4)
- https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-48282
Response Playbook
Triage
- Immediately query web server access logs for the source IP(s) for the past 72 hours and identify all URI paths requested — look for sequential traversal attempts indicating automated scanning versus targeted exploitation.
- Check HTTP response codes for traversal attempts: HTTP 200 responses to paths containing traversal sequences are high-confidence indicators of successful file read. HTTP 400/403/404 may indicate failed attempts or WAF blocking.
- Determine if the targeted ColdFusion instance is internet-facing or internal-only. Internet-facing instances with CISA KEV status require immediate escalation and emergency patching.
- Inspect the traversal paths to identify which files were targeted: neo-security.xml and password.properties contain plaintext credentials; neo-runtime.xml contains datasource passwords; server.xml contains keystore paths.
Containment
- If exploitation is confirmed (HTTP 200 to traversal paths), immediately isolate the ColdFusion host at the network layer: remove from load balancer, apply ACLs to block external access on ports 80, 443, 8500, 8300 pending patch deployment.
- Deploy emergency WAF rules blocking traversal sequences (../, %2e%2e, %252e%252e, ..%2f, ..%5c) for all requests to ColdFusion endpoints as a temporary mitigation while patching is coordinated.
- Rotate all credentials stored in ColdFusion configuration files (neo-security.xml, password.properties) as a precaution if any traversal to those paths returned HTTP 200.
- Apply Adobe security bulletin APSB26-68 patch immediately — this vulnerability is in CISA KEV with active exploitation confirmed.
Evidence Collection
- Export the full IIS/Apache/Nginx access logs for the ColdFusion server covering the detection window plus 48 hours prior — preserve original log files with hash verification before any log rotation occurs.
- Capture the ColdFusion server's filesystem state: directory listings of CFIDE, cf_scripts, and the ColdFusion installation root; hash values of ColdFusion configuration files (neo-security.xml, neo-runtime.xml, password.properties, server.xml, web.xml) to detect modification.
- Collect ColdFusion application logs from {cf_root}/logs/ including application.log, exception.log, and server.log which may capture file read errors or stack traces indicating traversal exploitation.
- Preserve network flow data (NetFlow/IPFIX) for the ColdFusion server's ingress traffic for the detection window to identify the full scope of source IPs involved and any subsequent lateral movement.
Escalation Criteria
- !Escalate to P1/Critical Incident if any traversal path returned HTTP 200 to sensitive configuration files (neo-security.xml, password.properties, server.xml) — credential exposure likely and immediate credential rotation is required.
- !Escalate immediately if post-exploitation activity is detected: new files written to the ColdFusion webroot, new scheduled tasks created, reverse shell connections outbound from the ColdFusion process, or new admin accounts created in ColdFusion Administrator.
- !Escalate if the vulnerable ColdFusion instance has access to internal databases or backend systems — path traversal exploitation may chain to credential theft enabling lateral movement to database servers.
- !Escalate if the instance is processing PII, PHI, PCI, or other regulated data — regulatory breach notification obligations may apply within statutory timeframes.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access logs: raw entries containing traversal sequences in URI stem/query fields with corresponding HTTP response codes - >
ColdFusion configuration files: {cf_root}/lib/neo-security.xml, {cf_root}/lib/neo-runtime.xml, {cf_root}/lib/password.properties — review for unauthorized access timestamps via filesystem metadata - >
ColdFusion exception logs: {cf_root}/logs/exception.log — file-not-found or permission-denied errors from traversal attempts targeting non-existent paths - >
Windows Security Event Log (if applicable): Event ID 4663 (object access audit) on ColdFusion configuration files if file auditing is enabled - >
Network flow records: source IP, destination IP:port, bytes transferred — large response sizes to traversal requests indicate successful file reads
Tuning Guidance
Begin by establishing a baseline of legitimate ColdFusion URI patterns in your environment — particularly any applications that use URL-encoded path components for template includes (cfinclude) or custom routing. Add known scanner IPs (Qualys, Tenable, Rapid7, internal pen test ranges) to an allowlist to suppress authorized scan noise. If a WAF is in place upstream of ColdFusion, verify whether it decodes URIs before logging — double-encoded traversal sequences (%252e%252e) may only appear in WAF logs, not downstream web server logs. Tune severity thresholds based on ColdFusion instance criticality: internet-facing instances processing PII should alert at Critical; internal dev/staging instances may warrant a lower severity tier. If false positive rates remain high due to shared hosting or CDN path encoding, add a secondary condition requiring the response body size to exceed 1KB for traversal responses (indicating file content returned).
Hunting Queries
Retrospective hunt over 7 days for successful (HTTP 200) path traversal responses from ColdFusion endpoints. Sorted by response size descending — large responses may indicate file contents were returned to the attacker. This hunt surfaces exploitation that predates the detection rule deployment.
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ("/CFIDE/", "/cfide/", "/cf_scripts/", ".cfm", ".cfc")
and scStatus == 200
| where csUriQuery has_any ("../", "..%2f", "%2e%2e", "..%5c") or csUriStem has_any ("../", "..%2f", "%2e%2e")
| project TimeGenerated, cIP, csHost, csUriStem, csUriQuery, scStatus, scBytes
| order by scBytes descindex=web (sourcetype=iis OR sourcetype=apache_access) (uri_path="*.cfm*" OR uri_path="*/CFIDE/*" OR uri_path="*.cfc*") status=200 (uri_path="*../*" OR uri_path="*%2e%2e*" OR uri_query="*../*" OR uri_query="*%2e%2e*") earliest=-7d | eval response_kb=round(bytes/1024,2) | table _time, src_ip, host, uri_path, uri_query, status, response_kb | sort -response_kbTargeted hunt for traversal attempts specifically seeking ColdFusion credential files (neo-security.xml, password.properties) and cryptographic material. These targets indicate deliberate credential harvesting rather than opportunistic scanning and warrant immediate escalation regardless of HTTP response code.
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ("/CFIDE/", ".cfm", ".cfc")
| extend DecodedURI = url_decode(csUriStem)
| where DecodedURI has "../"
and DecodedURI has_any ("neo-security", "password.properties", "neo-runtime", "server.xml", "web.xml", ".pfx", ".pem", ".key")
| project TimeGenerated, cIP, csHost, csUriStem, DecodedURI, scStatus, scBytesindex=web (sourcetype=iis OR sourcetype=apache_access) (uri_path="*.cfm*" OR uri_path="*/CFIDE/*") earliest=-7d | eval decoded_uri=urldecode(uri_path) | where match(decoded_uri, "(?i)(neo-security|password\.properties|neo-runtime|server\.xml|web\.xml|\.pfx|\.pem|\.key)") AND match(decoded_uri, "\.\./") | table _time, src_ip, host, uri_path, decoded_uri, status, bytesAtomic Red Team Tests
Simulates CVE-2026-48282 exploitation by sending a crafted HTTP GET request with directory traversal sequences to read the ColdFusion neo-security.xml credential store file via the CFIDE endpoint.
Command
curl -v -k --path-as-is 'http://TARGET_CF_HOST:8500/CFIDE/administrator/../../lib/neo-security.xml' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'Cleanup
No cleanup required — this is a read-only test. Review web server access logs to confirm the request was logged with the traversal sequence intact.Expected Telemetry
IIS/Apache access log entry: GET /CFIDE/administrator/../../lib/neo-security.xml with source IP of test host. HTTP response code 200 if vulnerable, 400/403 if patched or WAF-blocked.
Expected Detection
Alert should fire on detection of '../' sequence in URI path targeting a .cfm/.cfc/CFIDE endpoint. KQL: csUriStem contains '../../lib/neo-security.xml'. SPL: uri_path matches traversal pattern.
Tests URL-encoding bypass variant of CVE-2026-48282 using %2e%2e%2f encoding to evade naive string-matching defenses, targeting the ColdFusion password.properties file.
Command
curl -v -k --path-as-is 'http://TARGET_CF_HOST:8500/CFIDE/administrator/%2e%2e%2f%2e%2e%2flib%2fpassword.properties' -H 'Accept: */*'Cleanup
No cleanup required — read-only traversal test. Verify detection fires on %2e%2e encoded variant.Expected Telemetry
Web server access log entry with URL-encoded traversal sequence. If server decodes before logging, DecodedURI will contain '../lib/password.properties'. If logged raw, csUriStem will contain '%2e%2e%2f%2e%2e%2f'.
Expected Detection
Detection rule must match both raw encoded (%2e%2e) and decoded (../) forms. Chronicle YARA-L regex `%2[eE]%2[eE][/%5c]` should match. KQL `has_any("%2e%2e")` should trigger.
Tests double-URL-encoding bypass variant where % is itself encoded as %25, producing %252e%252e. Some WAFs decode only once, allowing double-encoded payloads to reach ColdFusion which decodes twice.
Command
curl -v -k --path-as-is 'http://TARGET_CF_HOST:8500/CFIDE/administrator/%252e%252e%252f%252e%252e%252flib%252fneo-runtime.xml' -H 'User-Agent: Mozilla/5.0'Cleanup
No cleanup required. This test specifically validates whether the WAF decodes once (blocks) or twice (passes through to ColdFusion).Expected Telemetry
WAF logs should show the double-encoded payload. ColdFusion access logs may show decoded single-percent-encoded form if WAF decodes once before forwarding. Both log sources should be checked.
Expected Detection
KQL condition `has_any("%252e%252e")` should match the double-encoded form in raw logs. Detection should fire regardless of whether the WAF partially decodes the payload.
Simulates automated exploitation tooling sending multiple traversal probes to enumerate accessible ColdFusion configuration files, mimicking behavior observed with KEV-listed ColdFusion vulnerabilities.
Command
for target in 'lib/neo-security.xml' 'lib/password.properties' 'lib/neo-runtime.xml' 'logs/server.log' 'logs/application.log'; do echo "[*] Testing: $target"; curl -s -o /dev/null -w "%{http_code} %{size_download}\n" -k --path-as-is "http://TARGET_CF_HOST:8500/CFIDE/%2e%2e%2f%2e%2e%2f${target}"; sleep 1; doneCleanup
No cleanup required. All requests are read-only. Delete any local output files created during testing.Expected Telemetry
Multiple web server access log entries from the same source IP within a short window, each containing traversal sequences targeting different ColdFusion configuration file paths. HTTP response sizes will differ based on file accessibility.
Expected Detection
Aggregated detection logic (count-based) should fire on multiple traversal requests from same IP. SPL stats query grouping by src_ip should show request_count >= 4. KQL summarize should surface the IP with UniqueTargets populated.