Threat reportVulnerabilityTL-2026-1057
Multiple Critical Adobe ColdFusion Vulnerabilities (CVE-2026-48276 et al., APSB26-68) Enable Unauthenticated Remote Code Execution
Multiple Critical Adobe ColdFusion Vulnerabilities (TL-2026-1057), also tracked as APSB26-68, is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-02 and last reviewed 2026-07-28. It has no confirmed attribution, affects Adobe ColdFusion 2025, references 11 CVEs (CVE-2026-48276, CVE-2026-48283, CVE-2026-48277), maps to 21 MITRE ATT&CK techniques (T1005, T1021, T1036), and is covered by 9 detection rules and 32 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 11Referenced vulnerabilities
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 32Indicators of compromise
Key facts for TL-2026-1057
- Threat ID
- TL-2026-1057
- Also known as
- APSB26-68
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, education, manufacturing, technology, ecommerce, professional-services
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 32
- Updates
- 2026-07-28 · revalidated 1× · latest source
Malware and tooling in Multiple Critical Adobe ColdFusion Vulnerabilities
Malware and tooling: Behinder
How Multiple Critical Adobe ColdFusion Vulnerabilities works
Adobe's emergency bulletin APSB26-68 (June 30, 2026) patches 11 vulnerabilities in ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier), including six CVSS 10.0 flaws (two unrestricted file upload, three improper input validation, one path traversal) that let unauthenticated remote attackers achieve full code execution. Adobe reports no known in-the-wild exploitation as of disclosure, but the platform has a documented history of active APT and cybercriminal exploitation.
On June 30, 2026, Adobe issued security bulletin APSB26-68 as an out-of-cycle, Priority Rating 1 emergency advisory addressing 11 distinct vulnerabilities across ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier) on all supported platforms (Windows, Linux). The bulletin was released alongside a related Adobe Campaign Classic advisory (CVE-2026-48286, incorrect authorization, CVSS 10.0, on-premises ACC v7 <= 7.4.3 build 9396) that is tracked separately and not part of this ColdFusion threat record.
Six of the eleven ColdFusion CVEs carry the maximum CVSS base score of 10.0: CVE-2026-48276 and CVE-2026-48283 are unrestricted file upload flaws (CWE-434) that let an unauthenticated remote attacker upload and execute an arbitrary file (e.g., a JSP/CFM webshell) directly on the server without any privileges or user interaction. CVE-2026-48277, CVE-2026-48281, and CVE-2026-48316 are improper input validation issues (CWE-20) that achieve arbitrary code execution through malformed request handling. CVE-2026-48282 is a critical path traversal flaw (CWE-22) that also chains to code execution.
Additional high-severity issues include CVE-2026-48313 (path traversal / CWE-22, CVSS ~9.3-10.0 depending on source, arbitrary file-system read enabling exposure of configuration files and credentials), CVE-2026-48315 (improper input validation / CWE-20, CVSS 9.3-10.0, privilege escalation), CVE-2026-48307 (reflected XSS / CWE-79, CVSS 8.8-10.0, reported via HackerOne by Matan Sandori and 2Bsecure), CVE-2026-48285 (SSRF / CWE-918, CVSS 8.6-10.0, security feature bypass enabling pivoting to internal resources), and CVE-2026-48314 (path traversal / CWE-22, lower/'Important' severity, privilege escalation).
CVE-2026-48283 and CVE-2026-48313 were credited to independent researcher Anirudh Anand. Adobe's advisory states it is not currently aware of any exploitation of these specific vulnerabilities in the wild, and as of this writing they do not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, ColdFusion is a historically high-value target: CISA advisory AA23-339A documented threat actors exploiting CVE-2023-26360 (improper access control) for initial access to a U.S. federal civilian executive branch agency in mid-2023, and China-nexus APT group Flax Typhoon (aka SLIME13) along with financially motivated actors were separately observed mass-exploiting CVE-2023-29300 (a Java/WDDX deserialization RCE) to deploy the Behinder webshell against dozens of internet-facing ColdFusion servers worldwide. This precedent means unpatched, internet-facing ColdFusion instances are a proven and repeatedly abused initial-access vector, and defenders should treat APSB26-68 with urgency (Adobe itself recommends deployment within 72 hours) despite the absence of confirmed exploitation at disclosure time.
Adobe additionally recommends administrators upgrade their MySQL Java Connector and review refreshed filter guidance to reduce exposure to insecure deserialization attacks as a defense-in-depth measure alongside the patch.
MITRE ATT&CK techniques used in TL-2026-1057
Collection
Lateral Movement
Defense Evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1486 Data Encrypted for Impact
Persistence
T1505 Server Software Component
Credential Access
credential-access
T1558 Steal or Forge Kerberos Tickets
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in Multiple Critical Adobe ColdFusion Vulnerabilities
Remediation for Multiple Critical Adobe ColdFusion Vulnerabilities
Patches
- ColdFusion 2025 Update 10
- ColdFusion 2023 Update 21
Immediate actions
- Upgrade to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 immediately
- Take internet-facing ColdFusion admin and CFM/CFC endpoints offline or restrict via firewall/WAF until patched
- Isolate ColdFusion servers from sensitive internal networks to limit SSRF (CVE-2026-48285) blast radius
- Audit web-accessible upload directories and recently modified/uploaded files for webshells (JSP, CFM, CFC)
- Rotate credentials and API keys stored on or accessible from ColdFusion servers given the path-traversal file-read flaws (CVE-2026-48313, CVE-2026-48314, CVE-2026-48282)
Workarounds
- Upgrade the bundled MySQL Java Connector and apply refreshed serialization-filter guidance to reduce insecure-deserialization exposure
- Restrict access to ColdFusion Administrator and upload-capable endpoints to trusted IP ranges pending patch deployment
Longer-term hardening
- Deploy EDR/webshell-detection tooling on all ColdFusion hosts
- Implement network segmentation restricting ColdFusion server egress to prevent SSRF pivoting
- Establish a documented patch-within-72-hours SLA for Adobe Priority 1 ColdFusion bulletins given repeated history of active exploitation of this product
- Move to ColdFusion's built-in Performance Monitoring Toolset / restrict CFIDE and admin endpoints to internal-only access
CVEs associated with Multiple Critical Adobe ColdFusion Vulnerabilities
CVE-2026-48276, CVE-2026-48283, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48313, CVE-2026-48315, CVE-2026-48285, CVE-2026-48307, CVE-2026-48314
Weaknesses (CWE) in Multiple Critical Adobe ColdFusion Vulnerabilities
Timeline of Multiple Critical Adobe ColdFusion Vulnerabilities
- Adobe APSB18-33 discloses CVE-2018-15961, an almost identical unauthenticated unrestricted-file-upload RCE at the same upload.cfm endpoint in ColdFusion's CKEditor filemanager, establishing this component as a recurring high-value target.
- Volexity documents active in-the-wild exploitation of CVE-2018-15961 by a suspected Chinese APT group, which deployed a China Chopper webshell via the same upload.cfm endpoint.
- Rapid7 and other researchers begin observing mass exploitation of ColdFusion CVE-2023-29300 (WDDX Java deserialization) to deploy the Behinder webshell, including by China-nexus APT group Flax Typhoon (SLIME13).
- Threat actors first established a foothold on a U.S. federal agency ColdFusion v2016 server, later attributed to exploitation of CVE-2023-26360 (per CISA AA23-339A) — cited as precedent for ColdFusion's history as an active-exploitation target.
- CISA adds the unrelated but precedent-setting ColdFusion improper-access-control flaw CVE-2024-20767 (arbitrary file-system read via the Performance Monitoring Toolset) to its Known Exploited Vulnerabilities catalog, requiring FCEB remediation by 2025-01-06 — further evidence that ColdFusion admin/monitoring components are a recurring real-world exploitation target.
- CrowdSec Network observes a fresh mass-scanning campaign against the previously-patched CVE-2024-20767, with over 100 distinct machines probing internet-facing ColdFusion servers in a single day — illustrating that even patched ColdFusion CVEs remain a persistent scanning/exploitation target well after disclosure.
- Adobe publishes the prior ColdFusion security bulletin APSB26-38, shipping ColdFusion 2025 Update 7 and ColdFusion 2023 Update 19 to fix arbitrary code execution, DoS, arbitrary file-system read, and security-feature-bypass flaws — the immediately preceding patch cycle to APSB26-68, showing a roughly quarterly cadence of critical ColdFusion fixes in 2026.
- Adobe releases ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21 fixing all 11 vulnerabilities.
- Adobe publishes emergency security bulletin APSB26-68, addressing 11 ColdFusion vulnerabilities (six rated CVSS 10.0) and a related Campaign Classic flaw (CVE-2026-48286), with Priority Rating 1.
- A sibling CVE from the same APSB26-68 bulletin, CVE-2026-48282 (RDS-based arbitrary file write RCE), is observed exploited in the wild within hours to days of patch release, with attack traffic geolocated to India.
- Adobe confirms in the bulletin that it is not aware of any exploitation of these specific CVEs in the wild at time of disclosure.
- Security media (BleepingComputer, The Hacker News, Cyber Security News, GBHackers, SecurityWeek, Cyberpress) publish coverage summarizing the bulletin and urging rapid patching.
- Threat added to Threadlinqs Intelligence Platform tracking (TL-2026-1057) as a CVSS 10.0-class enterprise RCE cluster warranting monitoring despite no confirmed in-the-wild exploitation yet.
- CISA adds CVE-2026-48282 to the Known Exploited Vulnerabilities (KEV) catalog and directs FCEB agencies to remediate by 2026-07-10.
- ShadowServer Foundation scanning identifies approximately 775 Adobe ColdFusion instances directly exposed to the internet without a WAF or administrative access restriction.
- Horizon3.ai publishes a technical deep-dive on CVE-2026-48283 and CVE-2026-48313; its NodeZero autonomous pentest platform achieves full NT AUTHORITY\SYSTEM compromise via the CKEditor upload.cfm extension-filter bypass in 1 minute 27 seconds during controlled Rapid Response testing.
Update history for TL-2026-1057
- 2026-07-28 — Critical Adobe ColdFusion CVEs: Unauthenticated RCE via CKEditor File Upload (CVE-2026-48283) and Path Traversal (CVE-2026-48313): What changed Exploitability POC_PUBLIC → ACTIVE and status PATCHED → ACTIVE: CVE-2026-48282, a sibling CVE from the same APSB26-68 bulletin already tracked on this threat, was confirmed exploited in the wild within days of patch release and
Sources cited for Multiple Critical Adobe ColdFusion Vulnerabilities
- Adobe Security Bulletin APSB26-68
- Multiple Adobe ColdFusion Vulnerabilities Let Attackers Execute Arbitrary Code
- Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic
- Adobe patches seven max severity ColdFusion, Campaign flaws
- Adobe ColdFusion Critical Flaws Enable Arbitrary Code Execution and File Read Attacks
- Adobe ColdFusion Critical Vulnerabilities Let Attackers Execute Arbitrary Code
- Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities
- Adobe Patches 11 ColdFusion, Campaign Classic Flaws; Four Hit Max Severity
- Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers (AA23-339A)
- Rapid7 Observed Exploitation of Adobe ColdFusion
- CVE-2023-29300: Adobe ColdFusion Vulnerability
- Hackers Exploited ColdFusion Vulnerability to Breach Federal Agency Servers
- CVE-2023-29300 Detail - NVD
- Kritiske ColdFusion-sårbarheder åbner for fuld serverovertagelse
- Adobe Security Bulletin APSB26-38 (ColdFusion 2025 Update 7 / 2023 Update 19)
Detection coverage for TL-2026-1057
As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1057 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.