Critical Adobe ColdFusion Vulnerabilities Let Attackers Run Code

Key Takeaways

• Adobe has released urgent security updates for ColdFusion 2025 and 2023.
• Multiple critical vulnerabilities, including remote code execution (RCE) flaws with CVSS scores of 10.0, have been addressed.
• Affected versions include ColdFusion 2025 Update 9 and earlier, and ColdFusion 2023 Update 20 and earlier.
• Administrators are strongly advised to patch immediately to ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21.
• While no active exploits are known, the severity and potential for unauthenticated network attacks demand prompt action.

Adobe Issues Critical Patches for ColdFusion RCE Vulnerabilities

Adobe has rolled out essential security updates for its ColdFusion platform, targeting both the 2025 and 2023 versions. These patches address a collection of serious vulnerabilities, some of which carry the maximum CVSS score of 10.0, posing a significant risk of arbitrary code execution, privilege escalation, and unauthorized file access.

The company has categorized these issues as Priority 1, indicating an urgent need for administrators to apply the updates, particularly in environments where there is a heightened risk of active exploitation. The vulnerabilities impact ColdFusion 2025 Update 9 and all prior iterations, along with ColdFusion 2023 Update 20 and earlier builds, across all supported operating systems.

To mitigate these risks, Adobe has released ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. The vendor strongly recommends that all customers upgrade to these patched versions without delay.

Deep Dive into Critical ColdFusion Vulnerabilities

Several of the recently disclosed vulnerabilities are rated with a critical CVSS score of 10.0. These flaws could allow unauthenticated attackers to execute arbitrary code remotely over a network connection. Such vulnerabilities stem from issues like unrestricted file uploads, path traversal, and insufficient input validation, which could enable threat actors to deploy malicious payloads or manipulate requests to seize complete control over affected ColdFusion servers.

Critical RCE Vulnerabilities Highlighted:

• CVE-2026-48276 and CVE-2026-48283: These vulnerabilities involve the unrestricted upload of files containing dangerous types (CWE-434), directly leading to arbitrary code execution. Both are rated with a CVSS score of 10.0.
• CVE-2026-48277, CVE-2026-48281, and CVE-2026-48316: These critical flaws are due to improper input validation (CWE-20), which can also result in arbitrary code execution, each scoring a CVSS of 10.0.
• CVE-2026-48282: A path traversal vulnerability (CWE-22) that facilitates arbitrary code execution, also with a CVSS score of 10.0.

Beyond the immediate threat of remote code execution, the update also addresses other critical weaknesses that could be exploited in a chain to achieve deeper system compromise.

• CVE-2026-48313: A significant path traversal bug that permits arbitrary file system reads, carrying a CVSS score of 9.3. This vulnerability significantly elevates the risk of exposing sensitive configuration data and credentials.
• CVE-2026-48315 and CVE-2026-48314: Privilege escalation is possible through CVE-2026-48315 (improper input validation, CVSS 9.3) and CVE-2026-48314 (path traversal, CVSS 6.5).
• The patch also resolves a reflected cross-site scripting (XSS) issue, CVE-2026-48307 (CVSS 8.8), and a critical Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-48285 (CVSS 8.6). The SSRF flaw could be leveraged to bypass security mechanisms and gain access to internal network resources.

While Adobe has stated it is currently unaware of any active exploits “in the wild” for these vulnerabilities, the combination of unauthenticated network access requirements, the maximum CVSS scores, and the historical interest of attackers in ColdFusion installations makes rapid patch deployment imperative for all internet-facing instances.

Adobe credits external researchers, including Anirudh Anand (a0xnirudh), Matan Sandori (matans1), and 2Bsecure, for their responsible disclosure of several of these vulnerabilities through the company’s HackerOne bug bounty program.

What You Should Do

• Immediately Apply Patches: Upgrade ColdFusion 2025 to Update 10 and ColdFusion 2023 to Update 21 without delay.
• Update JDK/JRE: Ensure your Java Development Kit (JDK) or Java Runtime Environment (JRE) is updated to the latest supported version.
• Update MySQL Java Connector: Use the most recent MySQL Java connector.
• Configure Serial Filter: Implement the serial filter to mitigate risks associated with insecure deserialization.
• Review Security Configuration: Apply all recommendations from the official ColdFusion Security Configuration and Lockdown Guide.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.