Summary
A maximum-severity remote code execution vulnerability in Adobe ColdFusion, tracked as CVE-2026-48282, is now being actively exploited in the wild — and attackers moved fast. Within just two hours of Adobe publishing security updates and disclosure details on July 6, vulnerability intelligence firm KEVIntel captured live exploitation against its global honeypot network.
The flaw affects ColdFusion versions 2025.9, 2023.20, and earlier, allowing unauthenticated attackers to achieve remote code execution on unpatched systems. Adobe flagged the vulnerability as posing a high risk of exploitation and urged administrators to deploy patches within 72 hours. The Canadian Center for Cyber Security (CCCS) has also issued an advisory confirming active exploitation and urging immediate patching.
Shadowserver currently tracks nearly 800 ColdFusion instances exposed to the internet, though it is unclear how many remain unpatched. This marks another in a long line of ColdFusion vulnerabilities being rapidly weaponized — CISA has catalogued 79 Adobe product vulnerabilities as actively exploited since November 2021, 10 of which have been abused in ransomware campaigns.
Source
BleepingComputer — Max severity Adobe ColdFusion flaw now exploited in attacks
Commentary
Two hours from disclosure to active exploitation. That is the reality defenders face in 2026 — there is effectively zero grace period between a patch dropping and exploitation beginning. For organizations still running ColdFusion in production, this should be a wake-up call to either maintain aggressive patching cycles or reconsider the platform entirely.
The speed here also underscores why vulnerability intelligence platforms like KEVIntel are becoming essential. Traditional patch management timelines measured in weeks or even days are no longer viable when attackers are weaponizing disclosures within the same news cycle. If you are running ColdFusion, patch now — not tomorrow, now.