CVE-2026-48282, CVSS 10.0, is a path traversal vulnerability in Adobe ColdFusion versions 2025.9, 2023.20, and earlier, leading to arbitrary code execution. CISA added it to the Known Exploited Vulnerabilities catalogue on 7 July 2026.
Path traversal reaching code execution, not just file disclosure
Path traversal vulnerabilities most commonly grant an attacker unauthorized file read — access to a configuration file or source code outside the intended directory boundary. CVE-2026-48282 is a more severe variant: the traversal here leads directly to arbitrary code execution, which typically means the vulnerable path lets an attacker write or overwrite a file the ColdFusion runtime will subsequently execute, rather than merely read one it shouldn't. That distinction is exactly why this CVE scores 10.0 rather than the more moderate score a read-only traversal bug would typically receive.
ColdFusion has a long-documented history as a target category in its own right — the platform has produced a steady stream of critical, actively-exploited vulnerabilities across many years, largely because it remains widely deployed in legacy enterprise web applications that were built years or decades ago and have not been migrated to a different stack since, often specifically because the migration cost is prohibitive relative to the application's perceived remaining value.
Why "versions 2025.9, 2023.20, and earlier" is a wide net
Naming two separate version lines — a 2025 release and a 2023 release, "and earlier" — as affected means this bug likely predates both named versions and has simply persisted across ColdFusion's release history until being found and fixed now. Organisations running any ColdFusion deployment that hasn't specifically confirmed patching against this CVE should assume they're in the affected population regardless of which named version they're closest to.
Why ColdFusion's pattern of recurring critical CVEs is not accidental
Legacy application platforms accumulate critical vulnerabilities at a higher rate than actively modernised stacks for a straightforward reason: the code was written under an older set of security assumptions, has been patched incrementally rather than redesigned, and receives security research attention specifically because its long history of critical findings makes it a productive target for researchers and attackers alike. ColdFusion's specific case is compounded by exactly the applications that still run on it — long-lived internal tools and legacy line-of-business applications, the kind of software that accumulates institutional dependency precisely because nobody wants to be the one who breaks it by touching it, which also means nobody is proactively re-architecting it away from a platform with this history.
What to check this week
Patch immediately, verifying against the specific version named rather than a general sense of currency. A CVSS 10.0 code-execution bug via path traversal, already confirmed exploited, does not tolerate a normal review cycle.
Audit ColdFusion application and server directories for any files that don't match expected deployment content. Path traversal reaching code execution typically means a written file is the mechanism; finding an unexpected file is direct evidence of compromise independent of log analysis.
Reconsider whether legacy ColdFusion applications still running in production have a realistic modernization or retirement path. This CVE is one entry in a long-running pattern for the platform; the underlying risk factor is the platform's continued presence in production long after most organisations' broader security posture has moved on from it.
The migration question this CVE should force, even if the answer is "not yet"
Not every organisation running ColdFusion is in a position to migrate away from it quickly, and this post does not suggest that's a realistic near-term fix for most. What it does suggest is that "we'll keep patching it" should be an explicit, revisited decision rather than a default nobody actively chose — a documented risk acceptance with a defined review date is a meaningfully different posture than an application nobody has evaluated the ongoing cost of running since it was deployed.
How Safeguard helps
Safeguard's continuous inventory flags legacy application platforms like ColdFusion specifically because of their documented, recurring history as a critical-vulnerability source — tracking them with heightened attention rather than the same cadence applied to actively maintained, modern stacks. Reachability analysis on a path-traversal-to-RCE bug like this one confirms exactly which deployed instances expose the vulnerable path, which matters most for organisations running several ColdFusion applications of varying vintage and patch discipline.
