ADVISORY SUMMARY
Adobe ColdFusion contains a CVSS 10.0 path traversal vulnerability that leads to arbitrary code execution. CISA added it to the KEV catalog on July 7, 2026 after exploitation was observed within hours of public disclosure, with at least one attempt recorded from an IP geolocated to India. All internet-facing ColdFusion servers should be treated as a fire-drill-category patch priority.
AFFECTED SYSTEMS
MITIGATION GUIDANCE
Apply Adobe's patches from the July 1, 2026 APSB26-68 advisory immediately. Treat any ColdFusion server accessible from the internet as highest priority regardless of patch lag. FCEB agencies were required to remediate by July 10, 2026 under BOD 26-04.
DETECTION SIGNATURES
Monitor IIS/ColdFusion access logs for path traversal sequences (e.g., '../', '%2e%2e%2f') targeting CFIDE or admin endpoints. Alert on unusual child process spawning from the ColdFusion JVM (e.g., cmd.exe, powershell.exe, sh). Correlate with EDR for post-exploitation file writes or reverse-shell beaconing.
INDICATORS OF COMPROMISE
REFERENCES
- → https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-three-known-exploited-vulnerabilities-catalog
- → https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html
- → https://nvd.nist.gov/vuln/detail/CVE-2026-48282