Adobe has issued an emergency security bulletin, APSB26-68, patching 11 vulnerabilities across ColdFusion 2025 and ColdFusion 2023, six of which hit the maximum CVSS severity of 10.0.
Released June 30, 2026, the bulletin carries Adobe’s top Priority Rating of 1, a classification reserved for flaws that attackers are either already exploiting or are extremely likely to target soon.
Adobe has confirmed it holds no current evidence of in-the-wild abuse, but the company is pressing all customers to patch without delay.
Adobe ColdFusion Critical Flaws
Collectively, the vulnerabilities open the door to arbitrary code execution, privilege escalation, unauthorized file system reads, and bypass of built-in security protections.
In practical terms, a remote attacker needing no valid credentials could seize full control of an exposed ColdFusion instance, making this one of the more dangerous patch cycles Adobe has shipped for the platform in recent memory.
The affected builds span ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier), covering every supported operating system. Fixes are packaged into ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, both already available for download.
| CVE Number | Weakness | Impact | Severity |
|---|---|---|---|
| CVE-2026-48276 | Unrestricted File Upload (CWE-434) | Arbitrary code execution | Critical |
| CVE-2026-48283 | Unrestricted File Upload (CWE-434) | Arbitrary code execution | Critical |
| CVE-2026-48277 | Improper Input Validation (CWE-20) | Arbitrary code execution | Critical |
| CVE-2026-48281 | Improper Input Validation (CWE-20) | Arbitrary code execution | Critical |
| CVE-2026-48316 | Improper Input Validation (CWE-20) | Arbitrary code execution | Critical |
| CVE-2026-48282 | Path Traversal (CWE-22) | Arbitrary code execution | Critical |
| CVE-2026-48313 | Path Traversal (CWE-22) | Arbitrary file system read | Critical |
| CVE-2026-48315 | Improper Input Validation (CWE-20) | Privilege escalation | Critical |
| CVE-2026-48307 | Reflected XSS (CWE-79) | Arbitrary code execution | Critical |
| CVE-2026-48285 | SSRF (CWE-918) | Security feature bypass | Critical |
| CVE-2026-48314 | Path Traversal (CWE-22) | Privilege escalation | Important |
The two file-upload bugs (CVE-2026-48276, CVE-2026-48283) let unauthenticated attackers drop and run malicious files directly on the server.
The trio of input-validation flaws (CVE-2026-48277, CVE-2026-48281, CVE-2026-48316) achieves the same outcome through malformed request handling, while CVE-2026-48282 rounds out the perfect-10 group via directory traversal leading to code execution.
Beyond the maximum-severity issues, CVE-2026-48313 exposes sensitive files via path traversal, CVE-2026-48307 allows attackers to bypass security controls via SSRF, and CVE-2026-48315 combines reflected XSS with adjacent-network access to achieve code execution.
The sole Important-rated bug, CVE-2026-48314, still permits privilege escalation through weak directory restrictions.
Researcher Anirudh Anand disclosed CVE-2026-48283 and CVE-2026-48313, while Matan Sandori and 2Bsecure reported CVE-2026-48307 through Adobe’s HackerOne bug bounty program.
According to Adobe advisory, administrators should upgrade their MySQL Java Connector and consult the refreshed filter guidance to reduce exposure to insecure deserialization attacks.
Given ColdFusion’s widespread use in enterprise web applications, organizations running internet-facing instances should treat this bulletin as an urgent, drop-everything patch and deploy Update 10 or Update 21 immediately to close these attack paths before they’re weaponized.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
