# Multiple Critical Adobe ColdFusion Vulnerabilities (CVE-2026-48276 et al., APSB26-68) Enable Unauthenticated Remote Code Execution

> Adobe's emergency bulletin APSB26-68 (June 30, 2026) patches 11 vulnerabilities in ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier), including six CVSS 10.0 flaws (two unrestricted file upload, three improper input validation, one path traversal) that let unauthenticated remote attackers achieve full code execution. Adobe reports no known in-the-wild exploitation as of disclosure, but the platform has a documented history of active APT and cybercriminal exploitation.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-28T16:48:24.587Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1057
- **ID:** TL-2026-1057
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48276, CVE-2026-48283, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48313, CVE-2026-48315, CVE-2026-48285, CVE-2026-48307, CVE-2026-48314

## Description

On June 30, 2026, Adobe issued security bulletin APSB26-68 as an out-of-cycle, Priority Rating 1 emergency advisory addressing 11 distinct vulnerabilities across ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier) on all supported platforms (Windows, Linux). The bulletin was released alongside a related Adobe Campaign Classic advisory (CVE-2026-48286, incorrect authorization, CVSS 10.0, on-premises ACC v7 <= 7.4.3 build 9396) that is tracked separately and not part of this ColdFusion threat record.

Six of the eleven ColdFusion CVEs carry the maximum CVSS base score of 10.0: CVE-2026-48276 and CVE-2026-48283 are unrestricted file upload flaws (CWE-434) that let an unauthenticated remote attacker upload and execute an arbitrary file (e.g., a JSP/CFM webshell) directly on the server without any privileges or user interaction. CVE-2026-48277, CVE-2026-48281, and CVE-2026-48316 are improper input validation issues (CWE-20) that achieve arbitrary code execution through malformed request handling. CVE-2026-48282 is a critical path traversal flaw (CWE-22) that also chains to code execution.

Additional high-severity issues include CVE-2026-48313 (path traversal / CWE-22, CVSS ~9.3-10.0 depending on source, arbitrary file-system read enabling exposure of configuration files and credentials), CVE-2026-48315 (improper input validation / CWE-20, CVSS 9.3-10.0, privilege escalation), CVE-2026-48307 (reflected XSS / CWE-79, CVSS 8.8-10.0, reported via HackerOne by Matan Sandori and 2Bsecure), CVE-2026-48285 (SSRF / CWE-918, CVSS 8.6-10.0, security feature bypass enabling pivoting to internal resources), and CVE-2026-48314 (path traversal / CWE-22, lower/'Important' severity, privilege escalation).

CVE-2026-48283 and CVE-2026-48313 were credited to independent researcher Anirudh Anand. Adobe's advisory states it is not currently aware of any exploitation of these specific vulnerabilities in the wild, and as of this writing they do not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, ColdFusion is a historically high-value target: CISA advisory AA23-339A documented threat actors exploiting CVE-2023-26360 (improper access control) for initial access to a U.S. federal civilian executive branch agency in mid-2023, and China-nexus APT group Flax Typhoon (aka SLIME13) along with financially motivated actors were separately observed mass-exploiting CVE-2023-29300 (a Java/WDDX deserialization RCE) to deploy the Behinder webshell against dozens of internet-facing ColdFusion servers worldwide. This precedent means unpatched, internet-facing ColdFusion instances are a proven and repeatedly abused initial-access vector, and defenders should treat APSB26-68 with urgency (Adobe itself recommends deployment within 72 hours) despite the absence of confirmed exploitation at disclosure time.

Adobe additionally recommends administrators upgrade their MySQL Java Connector and review refreshed filter guidance to reduce exposure to insecure deserialization attacks as a defense-in-depth measure alongside the patch.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1140 Deobfuscate/Decode Files or Information
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1090 Proxy
- T1486 Data Encrypted for Impact
- T1588 Obtain Capabilities
- T1036 Masquerading
- T1558 Steal or Forge Kerberos Tickets
- T1021 Remote Services
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol

## Sources

- [Adobe Security Bulletin APSB26-68](https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html)
- [Multiple Adobe ColdFusion Vulnerabilities Let Attackers Execute Arbitrary Code](https://cybersecuritynews.com/multiple-adobe-coldfusion-vulnerabilities/)
- [Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic](https://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.html)
- [Adobe patches seven max severity ColdFusion, Campaign flaws](https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/amp/)
- [Adobe ColdFusion Critical Flaws Enable Arbitrary Code Execution and File Read Attacks](https://cyberpress.org/adobe-coldfusion-critical-flaws/)
- [Adobe ColdFusion Critical Vulnerabilities Let Attackers Execute Arbitrary Code](https://gbhackers.com/adobe-coldfusion-critical-vulnerabilities/)
- [Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities](https://www.securityweek.com/adobe-patches-critical-coldfusion-campaign-classic-vulnerabilities/)
- [Adobe Patches 11 ColdFusion, Campaign Classic Flaws; Four Hit Max Severity](https://securitypointbreak.com/2026/06/30/adobe-patches-11-coldfusion-campaign-classic-flaws-four-hit-max-severity/)
- [Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers (AA23-339A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-339a)
- [Rapid7 Observed Exploitation of Adobe ColdFusion](https://www.rapid7.com/blog/post/2023/03/21/etr-rapid7-observed-exploitation-of-adobe-coldfusion/)
- [CVE-2023-29300: Adobe ColdFusion Vulnerability](https://teamt5.org/en/posts/alerts-of-exploiting-adobe-cold-fusion-cve-2023-29300/)
- [Hackers Exploited ColdFusion Vulnerability to Breach Federal Agency Servers](https://thehackernews.com/2023/12/hackers-exploited-coldfusion.html)
- [CVE-2023-29300 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2023-29300)
- [Kritiske ColdFusion-sårbarheder åbner for fuld serverovertagelse](https://cert.dk/news/2026-07-01/Kritiske-ColdFusion-saarbarheder-aabner-for-fuld-serverovertagelse)
- [Adobe Security Bulletin APSB26-38 (ColdFusion 2025 Update 7 / 2023 Update 19)](https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1057