Adobe Patches Critical ColdFusion Flaws That Allow Remote Code Execution

Adobe has released emergency security updates for ColdFusion 2025 and ColdFusion 2023 to fix multiple critical vulnerabilities that can lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass.

The flaws are covered in Adobe security bulletin APSB26-68, published on June 30, 2026. Adobe assigned the update a Priority 1 rating, which means administrators should install it as soon as possible on affected systems.

The update affects ColdFusion 2025 Update 9 and earlier, and ColdFusion 2023 Update 20 and earlier. Adobe fixed the issues in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21 across all supported platforms.

ColdFusion 2025 and 2023 Systems Need Immediate Patching

The most urgent risk comes from six vulnerabilities with a CVSS score of 10.0. These flaws can allow unauthenticated attackers to execute arbitrary code remotely without user interaction.

That combination makes the update especially important for internet-facing ColdFusion servers. Adobe says it is not aware of public exploitation, but ColdFusion has a long history of attracting attacker interest once technical details become available.

The vulnerable versions are common in enterprise environments where ColdFusion supports internal portals, public-facing applications, administration tools, and legacy business systems.

Product	Affected versions	Fixed version	Priority
ColdFusion 2025	Update 9 and earlier	Update 10	Priority 1
ColdFusion 2023	Update 20 and earlier	Update 21	Priority 1

Six Critical Bugs Carry CVSS 10.0 Scores

The highest-severity issues include unrestricted file upload, improper input validation, and path traversal vulnerabilities. Adobe says each of these flaws can lead to arbitrary code execution.

The CVSS 10.0 issues are CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, and CVE-2026-48283. Several can be exploited over the network without privileges or user interaction.

In practical terms, successful exploitation could let an attacker run commands in the context of the ColdFusion server process. Depending on server permissions, that could expose application code, configuration files, credentials, databases, and connected internal services.

CVE	Vulnerability type	Impact	CVSS score
CVE-2026-48276	Unrestricted upload of dangerous file types	Arbitrary code execution	10.0
CVE-2026-48277	Improper input validation	Arbitrary code execution	10.0
CVE-2026-48281	Improper input validation	Arbitrary code execution	10.0
CVE-2026-48316	Improper input validation	Arbitrary code execution	10.0
CVE-2026-48282	Path traversal	Arbitrary code execution	10.0
CVE-2026-48283	Unrestricted upload of dangerous file types	Arbitrary code execution	10.0

Other ColdFusion Flaws Also Create Serious Risk

Adobe also fixed CVE-2026-48313, a path traversal vulnerability that can allow arbitrary file system read. This flaw has a CVSS score of 9.3 and could expose configuration files, secrets, logs, or other sensitive server-side data.

CVE-2026-48315 is another high-impact issue. Adobe describes it as an improper input validation vulnerability that can lead to privilege escalation and also carries a CVSS score of 9.3.

The update also fixes CVE-2026-48307, a reflected cross-site scripting issue that can lead to arbitrary code execution, and CVE-2026-48285, an SSRF vulnerability that can lead to security feature bypass. CVE-2026-48314 is rated important and can lead to privilege escalation.

• CVE-2026-48313 can expose files through path traversal.
• CVE-2026-48315 can enable privilege escalation through input validation failure.
• CVE-2026-48307 can lead to arbitrary code execution through reflected XSS.
• CVE-2026-48285 can allow SSRF-based security feature bypass.
• CVE-2026-48314 can lead to privilege escalation through path traversal.

Why ColdFusion Servers Are High-Value Targets

ColdFusion servers often sit close to sensitive business systems. They may connect to databases, file shares, identity systems, payment workflows, or internal APIs.

An attacker who gains code execution on a ColdFusion server may not stop at the web application. The server can become a foothold for credential theft, lateral movement, data exfiltration, or deeper compromise of the hosting environment.

This risk increases when ColdFusion runs with excessive permissions, exposes administrator interfaces to broad networks, or lacks strict security controls. Adobe’s ColdFusion security documentation recommends restricting administrator access, protecting exposed services, and using secure profile settings where appropriate.

Adobe Says No Exploits Are Known Yet

Adobe said it is not aware of any exploits in the wild for the vulnerabilities addressed in this update. That statement lowers the immediate exploitation signal, but it does not make the update optional.

Priority 1 advisories are reserved for updates that Adobe considers urgent because the affected products or platforms face a higher risk of being targeted. For public ColdFusion servers, administrators should treat this as a rapid patching event.

The official ColdFusion advisory also includes post-update hardening steps, including JDK or JRE updates, MySQL Java connector guidance, serial filter configuration, and Lockdown Guide recommendations.

Risk area	Possible attacker outcome	Admin priority
Remote code execution	Run malicious code on the server	Patch immediately
File system read	Steal secrets, configs, logs, or application files	Review exposure and rotate credentials if needed
Privilege escalation	Gain higher access inside the application or server	Review service permissions
SSRF	Reach internal services from the ColdFusion server	Restrict outbound access
XSS	Abuse user sessions or execute script in a victim context	Patch and review exposed interfaces

What Administrators Should Do Now

Administrators should upgrade ColdFusion 2025 installations to Update 10 and ColdFusion 2023 installations to Update 21. Systems running affected versions should move to the fixed releases before attackers have time to weaponize the flaws.

Teams should also verify that ColdFusion runs with limited operating system permissions. A remote code execution flaw becomes more damaging when the application server can write broadly, access sensitive directories, or reach internal systems without restrictions.

Adobe’s security guidance recommends administrator password protection, restricted access to ColdFusion Administrator, allowed IP controls, and secure profile configuration. Those controls can reduce risk if another flaw appears later.

• Install ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21.
• Confirm the update applied successfully on every node.
• Restrict access to ColdFusion Administrator and internal directories.
• Run ColdFusion with the least privileges required.
• Review file upload paths and application write permissions.
• Check for unusual files, modified templates, new scheduled tasks, and unexpected admin users.
• Restrict outbound network access to reduce SSRF impact.
• Review logs for suspicious requests before and after patching.

JDK, MySQL Connector, And Serial Filter Guidance

Adobe also recommends keeping the supported ColdFusion JDK or JRE LTS version up to date. This matters because Java runtime security affects the overall safety of the ColdFusion environment.

For database connectivity, Adobe points administrators to its MySQL JDBC driver guidance. The document explains how ColdFusion can use a newer MySQL Connector/J driver when organizations need newer driver features or updates.

Adobe also highlights its ColdFusion serial filter documentation, which describes JVM-level deserialization controls and ColdFusion-specific filtering. Deserialization protections help reduce exposure to unsafe Java object handling in vulnerable or misconfigured environments.

How To Prioritize The Update In Production

Internet-facing ColdFusion servers should move first. These systems face the most immediate risk because unauthenticated remote code execution flaws can be probed at scale once attackers build working exploit chains.

Next, patch ColdFusion servers that handle sensitive data, connect to privileged databases, or run administrative workflows. Internal-only systems still need attention because attackers often use compromised endpoints or VPN accounts to reach internal web applications.

Organizations that cannot patch immediately should reduce exposure while scheduling the update. This includes blocking public access to administrative paths, placing access behind VPN or allowlists, tightening upload handling, and monitoring for abnormal ColdFusion activity.

Patch priority	Server type	Reason
Highest	Internet-facing ColdFusion servers	Unauthenticated RCE bugs can be attacked remotely
High	Servers with database or file share access	Compromise may expose credentials and business data
High	Administrative or internal workflow systems	Attackers can use them for privilege escalation or lateral movement
Medium	Isolated test and development systems	They may still contain secrets or reusable code

Researchers Credited For The Reports

Adobe credited Anirudh Anand, also known as a0xnirudh, for reporting CVE-2026-48283 and CVE-2026-48313. The company also credited Matan Sandori, also known as matans1, and 2Bsecure for reporting CVE-2026-48307.

Several of the issues were reported through Adobe’s HackerOne bug bounty program. Responsible disclosure gives vendors time to build patches before public technical details increase exploitation risk.

The main takeaway for administrators is clear: patch first, then harden. The serial filter guide and MySQL connector guidance should be part of a wider ColdFusion maintenance review after the update is complete.

Bottom Line

Adobe’s ColdFusion update fixes a serious set of vulnerabilities, including six maximum-severity code execution flaws. Even without confirmed exploitation, the combination of unauthenticated access, network reachability, and ColdFusion’s history makes this a high-priority patch.

Administrators should update to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21, review server exposure, restrict administrator access, and check for signs of suspicious activity on affected systems.

Hardening should continue after patching. ColdFusion servers often have access to sensitive data and internal systems, so security teams should treat them as critical application infrastructure rather than ordinary web servers.

FAQ