CVE-2026-48282: Adobe ColdFusion Path Traversal Under Active Exploitation
Vulnerability Overview
CVE-2026-48282 is a path traversal vulnerability (CWE-22) in Adobe ColdFusion. Path traversal flaws arise when an application accepts user-supplied input that is used to construct filesystem paths without adequately sanitising directory traversal sequences such as ../ or URL-encoded equivalents. In ColdFusion's case, an unauthenticated or low-privileged attacker can craft malicious HTTP requests that escape the application's intended directory scope, enabling two distinct impact chains: arbitrary file read — accessing configuration files, credential stores, or other sensitive data outside the web root — and potentially remote code execution via file write primitives if the traversal path reaches writable locations that ColdFusion will subsequently interpret or execute.
Affected Software
This vulnerability affects Adobe ColdFusion. The vulnerability was disclosed on 2026-07-07 and no patch date has been confirmed at the time of writing. Defenders should treat all ColdFusion deployments as potentially exposed until Adobe publishes a fix and patching is confirmed across the environment.
Exploitation Status
CISA has added CVE-2026-48282 to the Known Exploited Vulnerabilities (KEV) catalogue, confirming active in-the-wild exploitation. KEV listing represents the highest-urgency exploitation tier: threat actors are weaponising this vulnerability against real targets right now, not in lab conditions. For defenders, this means patching timelines collapse from weeks to days, and detection coverage must be assumed operational today — not after the next patch cycle. ColdFusion servers exposed to the internet, or reachable from untrusted network segments, should be treated as priority targets.
Detection Coverage
The df00tech detection pack ships query coverage across seven SIEM platforms for this CVE:
- Microsoft Sentinel (KQL)
- Splunk (SPL)
- Elastic (EQL)
- IBM QRadar (AQL)
- Sumo Logic
- Google Chronicle (YARA-L)
- CrowdStrike (CQL)
The detection logic focuses on HTTP request telemetry sourced from web server logs, WAF events, and endpoint process data. Queries look for directory traversal patterns in URI paths — including both raw and URL-encoded forms of ../ sequences — directed at ColdFusion endpoints, particularly those associated with file access or administrative functionality. Secondary logic correlates file read or write activity on the ColdFusion host process against sensitive configuration paths, flagging attempts to reach credential files or web-accessible directories that could support a follow-on RCE chain. The combined coverage is designed to catch both the initial reconnaissance phase (read-only traversal probes) and more aggressive exploitation attempts involving file writes.
Full Detection
The complete detection rules, MITRE ATT&CK mappings, and purple team playbook are available on the CVE-2026-48282 detection page. Free-tier users can access the query logic directly; the paid tier includes the full playbook with atomic test procedures and triage guidance.