CISA Mandates Emergency Adobe ColdFusion Patch by Friday — Actively Exploited in the Wild

CISA has issued a mandatory patching order for a maximum-severity vulnerability in Adobe ColdFusion, giving federal agencies until this Friday to apply the fix — or take affected systems offline. The agency added the flaw to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. Attackers are already using this, not just security researchers.

The vulnerability carries a CVSS score of 10.0 — the maximum possible — and is tracked as CVE-2026-48282, classified as a path traversal flaw. At this severity level, a path traversal typically gives an unauthenticated attacker the ability to read arbitrary files on the server, execute remote code, or achieve full system compromise. Adobe ColdFusion is used in enterprise and government environments to power backend web applications, internal tooling, and business-critical APIs. A successful exploit opens the door to total server takeover and lateral movement into everything connected to it.

Why This Matters Beyond Federal Agencies

CISA's binding directives only formally apply to civilian federal agencies, but a Friday mandatory deadline on an actively exploited CVSS 10 is a signal the private sector should not wait on. "Actively exploited" in the KEV catalog means CISA has confirmed real-world attack evidence — not theoretical risk. Any internet-exposed ColdFusion instance should be treated as potentially already targeted. Legacy or rarely-touched ColdFusion servers — the kind that sit in corners of enterprise environments running something nobody wants to touch — are exactly what attackers look for.

What to Do Right Now

1. Inventory your exposure. Find every ColdFusion server in your environment, including dev, staging, and legacy systems. Check version numbers against Adobe's security advisory.

1. Apply Adobe's patch immediately. Adobe has released an update addressing this flaw. Treat this as an emergency change — do not defer to the next scheduled maintenance window.

1. If patching today is impossible, isolate the host. Remove the ColdFusion server from the public internet until the patch is applied. A WAF rule is not sufficient mitigation for a CVSS 10 path traversal with known active exploitation.

1. Check for existing compromise. Review web server access logs for unusual file-read patterns, unexpected outbound connections, or new privileged accounts. Applying the patch does not undo an intrusion that already happened.

1. Check the rest of this KEV batch. CISA simultaneously added actively exploited flaws in Joomla and Langflow to the catalog. If either is in your stack, those patches are equally urgent.

The Friday deadline is a federal mandate, but the exploitation clock runs for everyone. An unpatched, internet-facing ColdFusion server right now is a target.