# CISA adds Adobe ColdFusion flaw to KEV

Published: 2026-07-07 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/800e6687-6727-5e88-8145-30ea806be1c2/cisa-adds-adobe-coldfusion-flaw-to-kev

> CISA added an actively exploited Adobe ColdFusion path traversal vulnerability to its Known Exploited Vulnerabilities catalog, directing federal agencies to remediate quickly.

CISA has added CVE-2026-48282, a path traversal vulnerability in Adobe ColdFusion, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming evidence of active exploitation in the wild. Path traversal flaws remain a common vector for attackers to access sensitive files or achieve remote code execution on affected systems, making them a persistent risk for organizations running exposed ColdFusion instances.

Under Binding Operational Directive (BOD 26-04), Federal Civilian Executive Branch agencies are required to prioritize remediation of vulnerabilities in the KEV Catalog, particularly those that could grant an attacker total control of a publicly exposed asset. The directive also requires agencies to check whether systems were compromised prior to patching. While BOD 26-04 legally binds only FCEB agencies, CISA recommends all organizations adopt similar risk-based patching practices for KEV-listed vulnerabilities to reduce exposure to known exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-48282 (KEV)

## Detection guidance (public sample)

### ColdFusion Java Process Spawning Command Shell

ATT&CK: T1190

Detects cmd.exe, powershell.exe, or bash spawned by the ColdFusion Java process (coldfusion.exe/java.exe), consistent with post-exploitation of a path traversal/RCE vulnerability such as CVE-2026-48282. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process from ColdFusion Java Service
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \coldfusion.exe
    - \java.exe
    - \jrun.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \bitsadmin.exe
    - \certutil.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate ColdFusion administrative scripts that invoke OS commands (rare, should
  be baselined)
- Scheduled maintenance tasks configured to run via ColdFusion scheduler
level: high
tags:
- attack.t1190
- attack.execution
id: 3102f408-3919-5359-a750-274e483802a5
status: experimental
author: Vorant
```

### Web Shell File Write by ColdFusion Process in Webroot

ATT&CK: T1505.003

Detects creation of script files (jsp, cfm, cfc, jspx) by the ColdFusion process outside of expected deployment activity, indicating possible web shell drop following exploitation of a path traversal vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Script File Written by ColdFusion Process
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \coldfusion.exe
    - \java.exe
    - \jrun.exe
    TargetFilename|endswith:
    - .jsp
    - .jspx
    - .cfm
    - .cfc
  filter:
    TargetFilename|contains:
    - \wwwroot\CFIDE\administrator\
    - \cfusion\lib\
  condition: selection and not filter
falsepositives:
- Legitimate ColdFusion application deployment or developer publishing new .cfm/.cfc
  pages
- Automated build/CI pipelines that push CFML application code to the webroot
level: medium
tags:
- attack.t1505.003
- attack.persistence
id: 21be7d3e-68b4-500e-9cf1-1c7b127c74a4
status: experimental
author: Vorant
```

### Path Traversal Sequence in Web Request to ColdFusion Endpoint

ATT&CK: T1190

Detects HTTP requests containing directory traversal sequences (../ or encoded equivalents) targeting ColdFusion administrative or CFIDE paths, indicative of exploitation attempts against path traversal vulnerabilities like CVE-2026-48282. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Path Traversal Pattern Targeting ColdFusion Endpoints
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-query|contains:
    - ../
    - ..%2f
    - ..%5c
    - '%2e%2e/'
    - '%2e%2e%2f'
  selection_target:
    cs-uri-stem|contains:
    - /CFIDE/
    - /cf_scripts/
    - /coldfusion/
  condition: selection_path and selection_target
falsepositives:
- Vulnerability scanners or penetration testing tools probing ColdFusion instances
  as part of authorized assessments
- Legacy applications passing relative file paths in query parameters
level: medium
tags:
- attack.t1190
- attack.initial_access
id: 4442bc89-0297-59a7-8fa6-64338cc7ce43
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-one-known-exploited-vulnerability-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/800e6687-6727-5e88-8145-30ea806be1c2/cisa-adds-adobe-coldfusion-flaw-to-kev.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup