CISA Orders Federal Agencies to Patch Critical Adobe ColdFusion Flaw by July 10

The US Cybersecurity and Infrastructure Security Agency has ordered federal agencies to patch a maximum severity Adobe ColdFusion flaw by Friday, 10 July 2026, after confirming it is already being exploited in the wild.

The vulnerability, tracked as CVE-2026-48282, carries a CVSS score of 10.0 and sits in ColdFusion's Remote Development Services FILEIO handler. The component accepts a user supplied file path and forwards it to the underlying file system without proper validation, letting an unauthenticated attacker traverse outside the intended directory using standard path traversal sequences. Under the right configuration, that access escalates into full arbitrary code execution, no privileges or user interaction required.

Adobe released patches for the flaw on 30 June alongside six other maximum severity ColdFusion and Campaign Classic bugs, and at the time said it was not aware of any exploitation. That held for less than two days. KEVIntel founder Ryan Dewhurst reported that attackers began exploiting the bug within roughly two hours of technical details going public, prompting Canada's Cyber Centre to urge network defenders to secure their systems. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 7 July, triggering the Binding Operational Directive 26-04 remediation clock.

Notably, ColdFusion was not the only entry in that KEV batch. CISA also flagged a critical insecure direct object reference flaw in Langflow, which attackers were separately observed chaining with an earlier remote code execution bug to hijack other users' workflows, along with two actively exploited Joomla extension vulnerabilities, all under the same 10 July deadline. That clustering suggests CISA is treating this week's wave of web application platform exploitation as a coordinated push rather than an isolated advisory.

Why this is not just a US government problem

CISA's deadline is legally binding only on US federal civilian agencies, but the underlying exposure is global. The Shadowserver Foundation is currently tracking close to 800 internet facing ColdFusion instances, and there is no reliable way to know how many remain unpatched or have Remote Development Services enabled in a vulnerable state. ColdFusion's footprint skews heavily toward enterprise web applications with backend database and directory integrations, which means a successful path traversal here can open a direct line into far more sensitive systems than the web server itself. GCC enterprises are not exempt from this exposure simply because the CISA deadline applies elsewhere, and the same asset discovery work covered in MCW's guide to penetration testing for GCC regulatory vendors is directly applicable here.

Exploitation requires RDS to be enabled with authentication disabled, which is not the default configuration. That single mitigating detail is the difference between a theoretical bug and an urgent one for any organisation running ColdFusion, and it is exactly the kind of detail security teams across Saudi Arabia and the UAE enterprise markets need to check rather than assume.

What security teams should do now

Organisations running Adobe ColdFusion, regardless of sector or region, should treat this as an immediate action item rather than a routine patch cycle item. Adobe has published fixes in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21. Beyond applying the update, teams should confirm whether RDS is enabled on any internet facing instance and disable it if it is not actively required. Any server that has been internet facing in the past week should be checked for indicators of compromise, including unauthorised files inside the web root and the CFIDE directory structure, unexpected file uploads, and unusual outbound connections.

For enterprise security leaders across the Gulf managing mena cyber security news and broader mena cyber news feeds, the pattern here is a familiar one worth internalising again. A vulnerability moves from patch release to active exploitation in a matter of hours, not weeks, which is the same continuous monitoring discipline described in MCW's coverage of the GlassWorm malware campaign against GCC infrastructure. Any team responsible for gulf cyber security news monitoring should add ColdFusion instance discovery to this week's asset inventory review, since exposure at this severity does not wait for a scheduled audit cycle.