CVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability

EPSS trend

Probability

42.39%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 42.39% on 21-09-2026

21-09-202621-10-2026

EPSS score

42.39%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 07-07-2026
Federal due date: 10-07-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. helpx.adobe.com/security/products/coldfusion/apsb26-68.html nvd.nist.gov/vuln/detail/CVE-2026-48282

Public exploits

0 found

No public exploits indexed.

References

2 links

helpx.adobe.com/security/products/coldfusion/apsb26-68.htmlVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282Government ResourceUS Government Resource

Related vulnerabilities

CVE-2026-90530adobecoldfusion 2023+10.27%8d ago13-10-2026 20:21ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.CVE-2026-76001adobecoldfusion+20.52%8d ago13-10-2026 20:21ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.CVE-2026-75995adobecoldfusion+20.33%8d ago13-10-2026 20:21ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.CVE-2026-75994adobecoldfusion+20.33%8d ago13-10-2026 20:21ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.CVE-2026-75748adobecoldfusion+20.56%8d ago13-10-2026 20:21ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.CVE-2026-71385adobecoldfusion+20.40%8d ago13-10-2026 20:21ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

All vulnerabilities incoldfusion coldfusion 2023 coldfusion 2025

CVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References