Critical Adobe ColdFusion Vulnerability Exploited in Attacks

Hackers are exploiting a recently patched critical vulnerability (CVE-2026-48282) in Adobe ColdFusion that carries a CVSS score of 10/10. The post Critical Adobe ColdFusion Vulnerability Exploited in Attacks appeared first on SecurityWeek .

According to public reporting, a critical Adobe ColdFusion vulnerability (CVE-2026-48282, CVSS 10.0) is a path traversal flaw that allows unauthenticated remote attackers to achieve arbitrary code execution on affected ColdFusion 2025.9, 2023.20 and earlier versions, and it is already under active exploitation shortly after Adobe’s June 30 security updates.[3][5][6] CISA has added CVE-2026-48282 to its Known Exploited Vulnerabilities catalog, emphasizing that exposed ColdFusion servers require immediate patching and log review due to elevated risk to internet-facing systems.[2][3] From a RealGround perspective, this highlights AI supply chain risk: organizations running ColdFusion as part of web backends that serve or integrate with AI agents may have critical infrastructure compromise paths if these systems are not inventoried, patched, and monitored. Practically, security teams should treat ColdFusion as a high-risk third‑party component in their AI stack, ensure SBOM coverage and rapid patch management for such dependencies, and incorporate ColdFusion exploitation scenarios into continuous AI red teaming to test how compromise of backend services could impact AI agents’