CISA orders feds to patch max severity ColdFusion flaw by Friday

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies patch a critical vulnerability in Adobe ColdFusion by Friday. This directive, issued under Binding Operational Directive 26-04, targets a flaw designated CVE-2026-48282, which is actively being exploited by malicious actors.

The vulnerability affects Adobe ColdFusion versions 2025.9, 2023.20, and earlier iterations. Threat actors can exploit this flaw remotely, without requiring prior authentication or elevated privileges, and with minimal technical complexity. Successful exploitation can lead to code execution on unpatched systems, granting attackers control.

Adobe released security updates to address this vulnerability approximately one week prior to CISA's order, strongly advising administrators to implement the patches immediately due to a high risk of exploitation. The company stated that the update resolves vulnerabilities that are either currently being targeted or have a heightened risk of being targeted by exploits in the wild for specific product versions and platforms.

Security researchers have observed rapid exploitation of this flaw. Ryan Dewhurst, founder of KEVIntel, reported that attackers began exploiting CVE-2026-48282 within two hours of Adobe's public disclosure. Concurrently, the Canadian Centre for Cyber Security (CCCS) urged network defenders to take measures to protect their systems against these ongoing attacks.

Shadowserver, an internet security watchdog, is currently monitoring nearly 800 Adobe ColdFusion instances accessible online. However, it remains unclear how many of these are decoys (honeypots) or how many have been secured against attacks targeting CVE-2026-48282.

CISA added CVE-2026-48282 to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, prompting the directive for U.S. Federal Civilian Executive Branch (FCEB) agencies to patch their systems by Friday, June 10. Binding Operational Directive 26-04, established last month, requires federal agencies to prioritize patching based on factors including inclusion in the KEV catalog, the potential for automated large-scale attacks, the exposure of vulnerable assets online, and the level of control granted to attackers upon successful exploitation.

In addition to the actively exploited flaw, Adobe also addressed six other maximum-severity vulnerabilities in ColdFusion and its Campaign Classic marketing automation platform last week. These vulnerabilities were also flagged as having a high risk of being targeted. However, Adobe has not indicated that these other vulnerabilities are being exploited in the wild, stating it is unaware of any such exploitation.

This incident follows a pattern of vulnerabilities in Adobe products being actively exploited. Since November 2021, CISA has added 80 vulnerabilities in Adobe products to its KEV catalog, with 10 of these having been leveraged in ransomware attacks. Earlier this year, Adobe also issued emergency updates for a critical vulnerability in Acrobat Reader (CVE-2026-34621) that had been exploited as a zero-day since late 2025.