Attackers exploiting Adobe ColdFusion CVE-2026-48282

Attackers are now exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, the Canadian Centre for Cyber Security warned on Thursday. The CVE-2026-48282 security flaw affects ColdFusion versions 2025.9, 2023.20, and earlier. It can be exploited by attackers without privileges to gain remote code execution on unpatched systems. Two days after Adobe released patches, the CCCS, the Government of Canada authority that coordinates the country's national response to cybersecurity incidents, warned that threat actors have already begun exploiting CVE-2026-48282 and prompted defenders to secure their systems against ongoing attacks. "Open-source reporting indicates that CVE-2026-48282 is being exploited," the CCCS said. "The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates." BleepingComputer reported the development on July 6, 2026, citing the CCCS advisory and vulnerability intelligence company KEVIntel.