Multiple Critical Adobe ColdFusion Vulnerabilities (CVE-2026-48276 et al., APSB26-68) Enable Unauthenticated Remote Code Execution — Threadlinqs Intelligence
As of 2026-07-28, Multiple Critical Adobe ColdFusion Vulnerabilities (CVE-2026-48276 et al., APSB26-68) Enable Unauthenticated Remote Code Execution is a critical-severity vulnerability threat attributed to Unattributed (opportunistic, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 32 indicators of compromise.
Threat ID: TL-2026-1057 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
Updated: 2026-07-28 · revalidated 1× · latest source
Attribution: Unattributed (opportunistic · UNKNOWN
Adobe's emergency bulletin APSB26-68 (June 30, 2026) patches 11 vulnerabilities in ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier), including six CVSS 10.0 flaws
On June 30, 2026, Adobe issued security bulletin APSB26-68 as an out-of-cycle, Priority Rating 1 emergency advisory addressing 11 distinct vulnerabilities across ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier) on all supported platforms (Windows, Linux). The bulletin was released alongside a related Adobe Campaign Classic advisory (CVE-2026-48286, incorrect authorization, CVSS 10.0, on-premises ACC v7 <= 7.4.3 build 9396) that is tracked separately and not part of this ColdFusion threat record.
Six of the eleven ColdFusion CVEs carry the maximum CVSS base score of 10.0: CVE-2026-48276 and CVE-2026-48283 are unrestricted file upload flaws (CWE-434) that let an unauthenticated remote attacker upload and execute an arbitrary file (e.g., a JSP/CFM webshell) directly on the server without any privileges or user interaction. CVE-2026-48277, CVE-2026-48281, and CVE-2026-48316 are improper input validation issues (CWE-20) that achieve arbitrary code execution through malformed request handling. CVE-2026-48282 is a critical path traversal flaw (CWE-22) that also chains to code execution.
Additional high-severity issues include CVE-2026-48313 (path traversal / CWE-22, CVSS ~9.3-10.0 depending on source, arbitrary file-system read enabling exposure of configuration files and credentials), CVE-2026-48315 (improper input validation / CWE-20, CVSS 9.3-10.0, privilege escalation), CVE-2026-48307 (reflected XSS / CWE-79, CVSS 8.8-10.0, reported via HackerOne by Matan Sandori and 2Bsecure), CVE-2026-48285 (SSRF / CWE-918, CVSS 8.6-10.0, security feature bypass enabling pivoting to internal resources), and CVE-2026-48314 (path traversal / CWE-22, lower/'Important' severity, privilege escalation).
CVE-2026-48283 and CVE-2026-48313 were credited to independent researcher Anirudh Anand. Adobe's advisory states it is not currently aware of any exploitation of these specific vulnerabilities in the wild, and as of this writing they do not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, ColdFusion is a historically high-value target: CISA advisory AA23-339A documented threat actors exploiting CVE-2023-26360 (improper access control) for initial access to a U.S. federal civilian executive branch agency in mid-2023, and China-nexus APT group Flax Typhoon (aka SLIME13) along with financially motivated actors were separately observed mass-exploiting CVE-2023-29300 (a Java/WDDX deserialization RCE) to deploy the Behinder webshell against dozens of internet-facing ColdFusion servers worldwide. This precedent means unpatched, internet-facing ColdFusion instances are a proven and repeatedly abused initial-access vector, and defenders should treat APSB26-68 with urgency (Adobe itself recommends deployment within 72 hours) despite the absence of confirmed exploitation at disclosure time.
Adobe additionally recommends administrators upgrade their MySQL Java Connector and review refreshed filter guidance to reduce exposure to insecure deserialization attacks as a defense-in-depth measure alongside the patch.
Weaknesses (CWE)
CWE-434, CWE-20, CWE-22, CWE-79, CWE-918
Target sectors: government administration, finance, health, education, manufacturing, technology, ecommerce, professional-services
Target regions: North America, Europe, Asia-Pacific, Global
Related threats
- Adobe ColdFusion & Campaign Classic Priority 1 Patches for 12 Vulnerabilities Including Six Maximum-Severity RCE Flaws (APSB26-68, APSB26-69)
- Adobe Patches Nine CVSS 10.0/9.3 Flaws in ColdFusion and Campaign Classic Enabling Arbitrary Code Execution (APSB26-68, APSB26-69)
- Adobe ColdFusion Critical Path Traversal in RDS FILEIO Handler Enables Unauthenticated RCE (CVE-2026-48282)
- Adobe Patches Seven Priority-1 ColdFusion and Campaign Classic Flaws (CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48282, CVE-2026-48316, CVE-2026-48286)
- Microsoft's MDASH AI Scanning Harness Uncovers 16 Windows CVEs, Including Four Critical RCE Flaws in TCP/IP, IKEv2, Netlogon, and DNS
- Adobe Campaign Classic Critical Incorrect Authorization Flaw Enables Unauthenticated Remote Code Execution (CVE-2026-48449) Paired With SQL Injection Memory/File Disclosure (CVE-2026-48448)
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 32 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-48276, CVE-2026-48283, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48313, CVE-2026-48315, CVE-2026-48285, CVE-2026-48307, T1595, T1587, T1190, T1203, T1059, T1505, T1068, T1211, T1140, T1552
