Adobe ColdFusion Critical Path Traversal Vulnerability CVE-2026-48282 Added to CISA KEV Under Active Exploitation

Executive Lead & Enterprise Application Server Threat Overview

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent binding directive by adding CVE-2026-48282 to its Known Exploited Vulnerabilities (KEV) catalog. Classified with a maximum severity rating of CVSS 9.8 Critical, the flaw represents an unauthenticated path traversal vulnerability (CWE-22) in Adobe ColdFusion, a widely used commercial enterprise rapid application development platform and Java-based application server.

Adobe ColdFusion powers mission-critical web applications, enterprise document management hubs, payment gateways, and government services. Because ColdFusion executes within an underlying Java Virtual Machine (JVM) that frequently possesses direct filesystem access and system privileges, vulnerabilities that compromise access control boundaries represent severe enterprise risks. In-the-wild telemetry reveals that threat actors are actively leveraging this flaw to bypass perimeter authentication filters, read arbitrary files from server storage, harvest administrative master passwords, and forge authenticated administrative sessions to achieve remote code execution (RCE).

Vulnerability Mechanics & Canonicalization Breakdown

The core flaw originates in how the internal ColdFusion servlet dispatcher processes incoming request paths targeting administrative and package management handlers located beneath /CFIDE/administrator/ and /CFIDE/adminapi/.

ColdFusion implements an access filter designed to restrict administrative servlets to authenticated user sessions or local loopback requests. However, when parsing incoming HTTP requests containing encoded directory traversal sequences (such as ..%2f, ..;/, or UTF-8 overlong encodings), the URL canonicalization routine executes inconsistently between the front-end web server connector (e.g., Apache HTTP Server or Microsoft IIS connector) and the underlying Tomcat-based servlet container:

GET /CFIDE/packages/..%252fadministrator/logs/viewLog.cfm?file=../../../../../../etc/passwd HTTP/1.1
Host: coldfusion.enterprise.corp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: */*

During request processing:

1. The front-end connector evaluates the path against access control lists, determining that the path prefix (/CFIDE/packages/) represents a public, non-administrative resource.
2. The request passes to the internal ColdFusion servlet engine, which performs secondary path normalization, resolving the traversal to the protected log viewing component (viewLog.cfm).
3. Because the authorization check occurred prior to normalization, the endpoint executes without checking for active administrative session tokens.
4. The file parameter is subsequently processed without strict base directory confinement, enabling the remote attacker to traverse the local filesystem and read sensitive configuration files, including neo-security.xml, password.properties, and application database source files.

Threat Actor Exploitation Lifecycle: From File Read to Root RCE

Incident response telemetry from recent enterprise breaches reveals a multi-stage attack chain leveraged by advanced persistent threat (APT) groups:

• Cryptographic Seed & Hash Extraction: Attackers retrieve ColdFusion's neo-security.xml file containing the encrypted administrator password and the cryptographic salt/seed used for session generation.
• Admin Session Cookie Forgery: Using the extracted encryption seeds, the attacker generates a forged CFAUTHORIZATION cookie locally, granting instant administrative access without triggering brute-force detection alarms.
• Scheduled Task Web Shell Staging: Logging into the ColdFusion Administrator interface, the attacker utilizes the "Scheduled Tasks" feature to schedule an HTTP download of an obfuscated .cfm web shell from an external command-and-control (C2) server, saving it directly into the web root directory.
• Lateral Movement & Database Compromise: With arbitrary CFM execution established, the adversary dumps datasource configurations, extracts SQL database credentials, and pivots across the internal corporate network.

Affected Versions & Remediation Baseline Matrix

Defensive Playbook & Hardening Checklist

Systems administrators and security engineering teams operating Adobe ColdFusion deployments must execute the following remediation actions immediately:

1. Immediate Update Installation via ColdFusion Administrator

Apply the corresponding security update (2023 Update 8 or 2021 Update 14) via the Server Update section in the ColdFusion Administrator console or deploy the hotfix jar manually:

# Stop the ColdFusion Application Service
systemctl stop coldfusion2023

# Execute the hotfix installer via Java
java -jar hotfix-packages/hf-2023-00008-330689.jar

# Restart the ColdFusion Application Service
systemctl start coldfusion2023

2. Restrict Access to the CFIDE Directory

The /CFIDE/administrator and /CFIDE/adminapi directories must never be accessible from the public internet. Restrict access at the web server tier (Apache/IIS/Nginx) to internal management IP addresses only:

# Apache HTTP Server: Restrict CFIDE administrator access
<Location "/CFIDE/administrator">
    Require ip 10.100.20.0/24
    Require ip 198.51.100.15
</Location>

<Location "/CFIDE/adminapi">
    Require ip 10.100.20.0/24
    Require ip 198.51.100.15
</Location>

3. Enforce ColdFusion Lockdown Tool Hardening

Execute the official Adobe ColdFusion Lockdown Tool to automatically disable unneeded services, disable RDS (Remote Development Services), configure dedicated unprivileged OS user accounts, and enforce secure file permissions across the installation directory.

4. Audit Scheduled Tasks and Web Roots for Rogue CFM Files

Inspect ColdFusion's scheduled tasks XML configuration (neo-cron.xml) and scan web roots for unrecognized CFM/CFML files created recently:

# Inspect neo-cron.xml for suspicious external URLs
grep -i "http" /opt/coldfusion2023/cfusion/lib/neo-cron.xml

# Find newly created or modified CFM files in the web root
find /var/www/html/ -name "*.cfm" -mtime -30 -ls