BCY-ADV-2026-015
CRITICAL — CVSS 10.0
Adobe ColdFusion — RDS FILEIO Path Traversal Leading to RCE
CVE-2026-48282 · Unauthenticated File Write · Webshell Deployment · NT AUTHORITY\SYSTEM
CVE-2026-48282
CVSS 10.0
CISA KEV
Path Traversal
RCE
Webshell
ColdFusion
Adobe
Unauthenticated
Actively Exploited
Public PoC
Prepared by Warren Barr · Barr Cyber LLC · barr-cyber.com · July 2026
What This Is
CVE-2026-48282 is a CVSS 10.0 path traversal vulnerability in Adobe ColdFusion's Remote Development Services (RDS) FILEIO handler — a legacy feature originally designed for IDE integration that allows file operations on the ColdFusion server. The FILEIO handler accepts a file path from the incoming request and passes it directly to the filesystem without canonicalization or boundary checking. An unauthenticated attacker can write arbitrary files to any location on the server, including the ColdFusion web root, by traversing out of the intended directory scope.
The practical result is unauthenticated remote code execution as NT AUTHORITY\SYSTEM on Windows (or the ColdFusion service account on Linux) within a single HTTP request. An attacker writes a CFML file containing <cfexecute> tags to a web-accessible path, then sends a second request to trigger it. CISA added this to the Known Exploited Vulnerabilities catalog on July 8, 2026 with a two-day federal deadline. Honeypot telemetry confirmed active exploitation before the KEV addition. Watchtowr Labs published a public proof-of-concept with full technical root-cause analysis.
This only affects ColdFusion servers where RDS is enabled with RDS authentication disabled. That is not the default configuration — but it is extremely common on legacy deployments and servers built from older documentation that left RDS open. If your ColdFusion server has RDS enabled, assume exposure.
CVE Details
CVE: CVE-2026-48282
CVSS v3.1: 10.0 CRITICAL
CWE: CWE-22 (Path Traversal)
CISA KEV: Yes — added July 8, 2026. Federal deadline July 10, 2026 (BOD 26-04)
Vendor patch: Adobe Security Bulletin APSB26-68, released June 30, 2026
Fixed in: ColdFusion 2025 Update 10, ColdFusion 2023 Update 21
Affected: ColdFusion 2025 Update 9 and earlier; ColdFusion 2023 Update 20 and earlier
Condition: RDS enabled with RDS authentication disabled (legacy or misconfigured deployments)
Authentication required: None
Public PoC: Yes — Watchtowr Labs (published post-patch, actively being weaponized)
How It Works
ColdFusion's RDS feature was built to let developer IDEs (ColdFusion Builder, Dreamweaver, the Eclipse plugin) communicate with a running ColdFusion server — browse the filesystem, execute queries, interact with data sources. The FILEIO handler, exposed at /CFIDE/main/ide.cfm?ACTION=FILEIO, supports read, write, create, rename, and delete operations on files.
Before the patch, the FILEIO handler trusted the file path supplied in the incoming request and passed it directly to the ColdFusion filesystem API without canonicalization or boundary validation. An attacker could supply a traversal sequence in the path parameter to exit the intended directory and reach any location on the server — including the ColdFusion web root. Unlike most path traversal bugs that only allow file reads, FILEIO is a full file management handler: it can write arbitrary content to arbitrary paths.
The attack sequence is two HTTP requests:
Request 1 — Write webshell: POST to the FILEIO endpoint with a traversal path pointing to a web-accessible directory (e.g., /CFIDE/ or the ColdFusion web root), with a CFML file containing <cfexecute name="#URL.cmd#"> tags as the file content.
Request 2 — Execute webshell: GET or POST to the newly written CFML file with a cmd parameter. ColdFusion executes it as NT AUTHORITY\SYSTEM on Windows or as the ColdFusion service account on Linux (which typically has broad filesystem and database access).
From persistent webshell access, attackers establish additional persistence (scheduled tasks, registry run keys, additional webshells in multiple locations) before detection, making the server difficult to clean without a full rebuild.
Detection
Check whether RDS is enabled and authentication status:
# ColdFusion Administrator → Security → RDS
# Check: Enable RDS Service (should be disabled)
# Check: Require a password (if RDS is enabled, this MUST be enabled)
# If RDS is enabled with no password requirement, the server is vulnerable
# regardless of patch status — disable RDS immediately.
Check ColdFusion version from Administrator:
# ColdFusion Administrator (typically http://server/CFIDE/administrator/)
# Home → Server Settings → Version Information
# ColdFusion 2025: must be Update 10 or later
# ColdFusion 2023: must be Update 21 or later
# Earlier updates with RDS enabled are vulnerable
Hunt for webshells in ColdFusion web root (Windows):
# Search for CFML files containing cfexecute (webshell indicator)
# Run from ColdFusion installation directory
Get-ChildItem -Path "C:\ColdFusion*" -Recurse -Include "*.cfm","*.cfc" |
Select-String -Pattern "cfexecute|CreateObject.*Shell|runtime.*exec" |
Select-Object Path, LineNumber, Line
# Look for recently created/modified CFML files (last 14 days)
Get-ChildItem -Path "C:\ColdFusion*" -Recurse -Include "*.cfm","*.cfc" |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
Select-Object FullName, LastWriteTime
Check web server logs for FILEIO exploitation attempts:
# Look for POST requests to the FILEIO endpoint
# In IIS logs (typically C:\inetpub\logs\LogFiles\W3SVC1\)
Select-String -Path "C:\inetpub\logs\LogFiles\W3SVC1\*.log" `
-Pattern "FILEIO|ide\.cfm" | Select-Object -First 50
# Look for traversal sequences in requests
Select-String -Path "C:\inetpub\logs\LogFiles\W3SVC1\*.log" `
-Pattern "\.\./" | Select-Object -First 50
Verify /CFIDE/main/ide.cfm accessibility (external test):
# From an external machine, check if the RDS endpoint is reachable
# A 200 response with RDS content confirms exposure
curl -I "https://your-cf-server.com/CFIDE/main/ide.cfm?ACTION=FILEIO"
# Expected safe response: connection refused, 403 Forbidden, or 404
# A 200 or redirect to RDS login = exposed endpoint
IOCs
Exploit endpoint /CFIDE/main/ide.cfm?ACTION=FILEIO
Webshell content CFML files containing <cfexecute> tags
Webshell paths /CFIDE/*.cfm, ColdFusion web root, any web-accessible directory
Common names shell.cfm, cmd.cfm, webshell.cfm, test.cfm, upload.cfm (vary)
CFML marker <cfexecute name="#URL.cmd#"> or <cfexecute name="#FORM.c#">
Log pattern POST requests to ide.cfm with FILEIO action + path traversal
CISA KEV CVE-2026-48282 added July 8, 2026. Federal deadline July 10, 2026.
Public PoC Watchtowr Labs — published post-patch, actively weaponized
Remediation
Adobe patched this on June 30 and initially stated they were "not aware of exploits in the wild." CISA added it to KEV on July 8 — nine days later. Honeypot data confirmed exploitation before the KEV addition. The patch-to-exploit window for ColdFusion vulnerabilities has historically been measured in days. If you run ColdFusion and did not patch within the first 48 hours of APSB26-68, perform a webshell hunt before declaring the server clean.
Sources & References
BCY-ADV-2026-015 · Published July 2026 · Barr Cyber LLC · Kalispell, MT
More like this, when it happens
Advisories only. No newsletter, no marketing, unsubscribe in one click.
Barr Cyber — Application Security & Incident Response
ColdFusion deployments with RDS exposed and outdated patch levels are a common finding in network assessments. If you run ColdFusion and haven’t had the server externally reviewed, or if you need help hunting for webshells after potential exposure, contact Barr Cyber.
Get in Touch →
