Attackers started exploiting this vulnerability two hours after it went public
Your patch window closed before most teams finished reading the advisory.
CVE-2026-48282 — Adobe ColdFusion, CVSS 10.0, maximum severity. A path traversal flaw in the Remote Development Services FILEIO handler lets an unauthenticated attacker achieve full remote code execution as the ColdFusion service account — NT AUTHORITY\SYSTEM on Windows.
WHAT ACTUALLY HAPPENED
The exposed endpoint sits at /CFIDE/main/ide.cfm?ACTION=FILEIO. Insufficient path validation there lets a specially crafted HTTP request write arbitrary files to the server's filesystem — no authentication required. Attackers drop a CFML webshell using <cfexecute> tags into a web-accessible directory and get command execution immediately after.
CISA confirmed active exploitation and added the CVE to the Known Exploited Vulnerabilities catalog, with a July 10 remediation deadline for federal agencies. Adobe ColdFusion 2025 update 9 and earlier, and 2023 update 20 and earlier, are affected. Fixed versions: 2025 Update 10 and 2023 Update 21.
WHY A TWO-HOUR WINDOW CHANGES YOUR PROCESS
A CVSS 10.0 unauthenticated RCE with a public technical writeup does not give you a patch cycle — it gives you a race. The gap between disclosure and mass exploitation used to be measured in days. Here it was measured in hours. Vulnerability management processes built around weekly or monthly patch windows are structurally too slow for this class of flaw.
WHAT TO DO NOW
PATCH TO 2025 UPDATE 10 OR 2023 UPDATE 21 IMMEDIATELY — do not wait for a scheduled maintenance window on an unauthenticated RCE this severe.
CHECK FOR THE ENDPOINT'S EXPOSURE RIGHT NOW — if /CFIDE/main/ide.cfm is reachable from the internet, assume compromise attempts have already occurred and hunt accordingly.
HUNT FOR WEBSHELLS IN WEB-ACCESSIBLE DIRECTORIES — look specifically for unexpected .cfm files containing <cfexecute> tags written in the last two weeks.
RESTRICT RDS ACCESS BY DEFAULT — Remote Development Services should never be internet-facing in a production deployment; if it is, that is the finding, not just the CVE.
CVSS 10.0 plus unauthenticated plus two-hour exploitation is the combination that defines this class of emergency. Everything else on your patch queue can wait behind it.
Does your patch process have an emergency lane for CVSS 10.0 unauthenticated RCEs, or does everything move through the same queue?