In a fresh update, Adobe closed a set of dangerous vulnerabilities, some of which could allow the code to be executed on the server.
The issues affect Adobe ColdFusion 2025 until updating 9 inclusive and ColdFusion 2023 before the update 20 inclusive. In the bulletin APSB26-68, the company listed several vulnerabilities with identifiers CVE-2026-48276 (10.0 Critical), CVE-2026-48277 (10.0 Critical), CVE-2026-4828218 (10.0 Critical), CVE-2026-48316 (10.0 Critical), CVE-2026-48282 (10.0 Cirtyal), CVE-2026-48283CVE-2026-48307CVE-2026-48313CVE-2026-48315CVE-2026-48285CVE-2026-48314 Some of the bugs made it possible to perform arbitrary code, read files, increase privileges or bypass protective mechanisms.
WatchTowr Labs specialists analyzed the fixes in detail and drew attention to the RDS module, which ColdFusion is used for remote development. Through it, the development environment can access the working ColdFusion server, view files, execute database requests, and help with debugging. By default, the RDS is disabled, and for the described attack, according to the watchTowr, the module must be turned on, and without authentication.
The most dangerous part is related to how file operations were processed. Before the correction, ColdFusion took the path to the file and transmitted it further without sufficient verification. Because of this, the attacker could refer to other people's directories on the server, read an arbitrary file or write a new file to the selected place. After the update, Adobe began to canonically check the way by blocking the absolute paths, transitions to parent directories and attempts to go beyond the permitted area.
The ability to write a file turned the error from a data leak into a way to remotely execute the code. If an attacker could place the file in the ColdFusion web catalog, the server then executed the created file as part of the application. According to watchTower, the ability to arbitrarily write a file was probably received by the CVE-2026-48282 ID, and the ability to arbitrarily read the file - CVE-2026-48313, although experts have stated separately that Adobe does not always unambiguously associate the corrected areas of the code with specific CVE.
A separate block of problems, experts found in the file manager CKEditor, which is part of ColdFusion. In the corrected version, Adobe banned additional file extensions and began to check the way during downloading. The Vulnerable feature is also disabled by default, but if it was turned on manually, the downloader, according to watchTowr, could be available without authentication. In this case, the attacker could transfer a path that went beyond the permitted directory and write the file elsewhere on the server.
Another closed error allowed you to view the contents of directories through the CKEditor file manager. In addition, watchTowr noticed signs that the processing of individual ColdFusion tags related to downloading files, mail, web sockets, external resources and data conversion has changed. To exploit such problems, it was already necessary that the server has its own ColdFusion page with vulnerable code and user input.
Adobe has already released updates, so ColdFusion administrators should install fresh versions as soon as possible and separately check whether RDS is enabled, file uploading and file manager where they are not needed. In the case of such components, even a rare setting can become critical if the server is available from the Internet.
The issues affect Adobe ColdFusion 2025 until updating 9 inclusive and ColdFusion 2023 before the update 20 inclusive. In the bulletin APSB26-68, the company listed several vulnerabilities with identifiers CVE-2026-48276 (10.0 Critical), CVE-2026-48277 (10.0 Critical), CVE-2026-4828218 (10.0 Critical), CVE-2026-48316 (10.0 Critical), CVE-2026-48282 (10.0 Cirtyal), CVE-2026-48283CVE-2026-48307CVE-2026-48313CVE-2026-48315CVE-2026-48285CVE-2026-48314 Some of the bugs made it possible to perform arbitrary code, read files, increase privileges or bypass protective mechanisms.
WatchTowr Labs specialists analyzed the fixes in detail and drew attention to the RDS module, which ColdFusion is used for remote development. Through it, the development environment can access the working ColdFusion server, view files, execute database requests, and help with debugging. By default, the RDS is disabled, and for the described attack, according to the watchTowr, the module must be turned on, and without authentication.
The most dangerous part is related to how file operations were processed. Before the correction, ColdFusion took the path to the file and transmitted it further without sufficient verification. Because of this, the attacker could refer to other people's directories on the server, read an arbitrary file or write a new file to the selected place. After the update, Adobe began to canonically check the way by blocking the absolute paths, transitions to parent directories and attempts to go beyond the permitted area.
The ability to write a file turned the error from a data leak into a way to remotely execute the code. If an attacker could place the file in the ColdFusion web catalog, the server then executed the created file as part of the application. According to watchTower, the ability to arbitrarily write a file was probably received by the CVE-2026-48282 ID, and the ability to arbitrarily read the file - CVE-2026-48313, although experts have stated separately that Adobe does not always unambiguously associate the corrected areas of the code with specific CVE.
A separate block of problems, experts found in the file manager CKEditor, which is part of ColdFusion. In the corrected version, Adobe banned additional file extensions and began to check the way during downloading. The Vulnerable feature is also disabled by default, but if it was turned on manually, the downloader, according to watchTowr, could be available without authentication. In this case, the attacker could transfer a path that went beyond the permitted directory and write the file elsewhere on the server.
Another closed error allowed you to view the contents of directories through the CKEditor file manager. In addition, watchTowr noticed signs that the processing of individual ColdFusion tags related to downloading files, mail, web sockets, external resources and data conversion has changed. To exploit such problems, it was already necessary that the server has its own ColdFusion page with vulnerable code and user input.
Adobe has already released updates, so ColdFusion administrators should install fresh versions as soon as possible and separately check whether RDS is enabled, file uploading and file manager where they are not needed. In the case of such components, even a rare setting can become critical if the server is available from the Internet.
