CVE-2026-48362 (CVSS 10.0): Adobe ColdFusion’s Unauthenticated OS Command Injection — 72-Hour Patch Window Closes Today

Adobe’s self-imposed 72-hour Priority 1 patch window for security bulletin APSB26-90 expires today, August 14, 2026. At the centre of the bulletin sits CVE-2026-48362 — a CVSS 10.0 unauthenticated OS command injection flaw in Adobe ColdFusion that requires no credentials, no user click, and no special network access to exploit. A single malformed HTTP request sent to an internet-facing ColdFusion server is sufficient to hand an attacker operating-system-level code execution, potentially leading to complete host compromise. If your organisation runs ColdFusion 2025 Update 11 or earlier, or ColdFusion 2023 Update 22 or earlier, every minute of delay is a window for attackers.

Why ColdFusion Still Matters in 2026

Adobe ColdFusion powers tens of thousands of web applications globally — from legacy government portals and insurance platforms to university student management systems and healthcare scheduling tools. In India, ColdFusion has historically been deployed in central and state government digital services, several large-format BFSI (banking, financial services, and insurance) back-offices, and numerous public-sector undertakings. Many of these installations receive infrequent patching because ColdFusion is often treated as a “stable legacy” tier, not a live attack surface. That assumption just became extremely dangerous.

Past ColdFusion zero-days — including CVE-2023-26360 and CVE-2024-20767 — were exploited by Chinese nation-state threat actors (specifically clusters associated with APT41/Winnti) within days of disclosure to compromise US federal agencies. The same pattern should be expected here: the Automatable: Yes NVD rating confirms that exploitation requires no bespoke research once a working proof-of-concept surfaces.

CVE-2026-48362: Technical Breakdown

Vulnerability class: OS Command Injection (CWE-78). ColdFusion’s CFML runtime incorrectly processes attacker-controlled input before passing it to an OS-level command execution context. Because ColdFusion runs as a Java application server that natively bridges to the underlying operating system for certain operations — file I/O, process execution, and system calls — unsanitised input can escape the application layer entirely.

CVSS 3.1 vector breakdown:

Metric	Value	What It Means
Attack Vector	Network	Exploitable over the internet with no physical or LAN access
Attack Complexity	Low	No race conditions, special configs, or chained exploits needed
Privileges Required	None	No login, API key, or session cookie required
User Interaction	None	No victim click, email open, or page visit required
Scope	Changed	Exploitation crosses the ColdFusion process boundary to the OS and adjacent systems
Confidentiality / Integrity / Availability	High / High / High	Full data theft, data tampering, and service destruction are all in scope

In practice: an attacker who successfully exploits CVE-2026-48362 can execute arbitrary OS commands as the ColdFusion service account. On Windows deployments — which account for the majority of enterprise ColdFusion installations — this service frequently runs as SYSTEM or a high-privilege local account. That translates directly to credential harvesting via LSASS, lateral movement, ransomware staging, or exfiltration of the entire application database.

Compounding the risk, CVE-2026-48273 (CVSS 9.9) — an eval injection flaw patched in the same bulletin — provides a second unauthenticated code execution path if attackers find CVE-2026-48362 blocked by a WAF rule. Two independent CVSS 9.9+ unauthenticated RCE chains in a single bulletin is extraordinary, even by 2026 standards. The same update also addresses CVE-2026-34635 (CVSS 8.2), a hard-coded cryptographic key — a flaw that could allow attackers to decrypt ColdFusion’s encrypted configuration files even after the other two CVEs are patched, recovering database credentials stored at rest.

The Full APSB26-90 Severity Landscape

Adobe’s bulletin covers 17 CVEs across ColdFusion 2023 and 2025, all addressed in Update 12 (2025) and Update 23 (2023). The five highest-severity issues:

CVE	CVSS	Type	Impact
CVE-2026-48362	10.0	OS Command Injection	Unauthenticated arbitrary code execution
CVE-2026-48273	9.9	Eval Injection	Remote code execution
CVE-2026-71384	9.6	Incorrect Authorization	Application denial-of-service
CVE-2026-71386	8.8	Cross-Site Scripting	Admin account compromise
CVE-2026-34635	8.2	Hard-coded Cryptographic Key	Decryption of encrypted configs/credentials

The same Adobe patch release cycle also addressed Adobe Campaign Classic with two more CVSS 10.0 flaws — CVE-2026-71398 and CVE-2026-27302 (both incorrect authorization leading to arbitrary code execution) — affecting Campaign Classic v7 builds ≤ 7.4.3 (build 9399). Organisations running on-premise or hybrid Campaign Classic deployments must upgrade to v7 7.4.4 build 9400 immediately; Adobe-hosted cloud instances have already been remediated.

What You Should Do Right Now — Sanjay Seth’s Expert Playbook

In 25+ years of securing networks across India and the Asia-Pacific region, the pattern I see most often is this: organisations patch their perimeter (firewalls, VPN gateways) promptly but leave application-tier servers — exactly the kind of middleware like ColdFusion — on weeks-long or months-long patch cycles. This bulletin is a direct attack on that blind spot. Here is what I would advise any NOC/SOC team and IT leadership to action in the next 24 hours:

1. Inventory immediately. Run a network scan or query your CMDB for any hosts with TCP/8500 (ColdFusion default admin port) or TCP/80/443 serving ColdFusion responses. Tools like Shodan show over 12,000 ColdFusion instances internet-exposed globally — find yours before threat actors do.
2. Apply APSB26-90 today. Update ColdFusion 2025 to Update 12 (2025.0.12) and ColdFusion 2023 to Update 23 (2023.0.23). If patching cannot be completed within the next few hours, temporarily block inbound access to the ColdFusion admin interface at the perimeter and ensure the server is not directly internet-reachable.
3. Disable the ColdFusion Administrator from public access. The admin console (/CFIDE/administrator/) should never be internet-accessible. Restrict it to management VLANs or VPN-only access behind your zero-trust policy engine.
4. Enable enhanced security lockdown mode. ColdFusion’s built-in “ColdFusion Security Analyzer” and “Sandbox Security” features should be active on all production deployments. Post-patch, run ColdFusion’s own lockdown guide for your version.
5. Monitor for indicators of compromise. Check ColdFusion logs (cfserver.log, application.log, server.log) for unexpected process spawn events, outbound connections, or unfamiliar CFML template execution. Deploy an EDR alert for cf_root/runtime spawning child processes like cmd.exe, powershell.exe, or bash.
6. Apply zero-trust principles at the application layer. This incident reinforces why zero-trust architecture — where every application tier is treated as untrusted regardless of network position — is non-negotiable. See how attackers chained a FortiOS VPN flaw with ransomware earlier this week: application-level vulnerabilities are the new perimeter.
7. Don’t forget Campaign Classic. If you run Adobe Campaign Classic on-premise, patch to build 9400. CVSS 10.0 with no authentication means your marketing automation server could become a beachhead into your broader enterprise network.

India Context: Government and BFSI Exposure

Indian enterprises face a compounded risk. Many government digital infrastructure projects built in the 2008–2018 era selected ColdFusion for its rapid RAD (Rapid Application Development) capabilities. Unlike commercial SaaS platforms, these deployments are managed by in-house IT teams or system integrators with stretched patch cycles. Given that nation-state actors like Lazarus Group are actively targeting Indian infrastructure using freshly patched vulnerabilities, IT and cybersecurity officers at PSUs, banks, and state government agencies must treat APSB26-90 as a critical incident response event, not a routine patch cycle item.

The Reserve Bank of India’s IT Risk Framework and SEBI’s Cyber Security and Cyber Resilience Framework both require regulated entities to apply critical patches within defined SLAs — typically 24–72 hours for CVSS 9.0+ vulnerabilities. A CVSS 10.0 unauthenticated RCE leaves no room for delay.

Frequently Asked Questions

Is CVE-2026-48362 being actively exploited right now?

As of August 14, 2026, Adobe states it is not aware of active exploitation in the wild. However, the NVD rates the vulnerability as “Automatable: Yes”, meaning threat actors can develop and deploy exploit scripts without manual intervention. Historical precedent with ColdFusion (CVE-2023-26360, exploited within 48 hours of disclosure) strongly suggests that weaponised exploits will surface rapidly. Treat this as already-exploited from a risk-management perspective and patch accordingly.

Does a Web Application Firewall (WAF) provide adequate protection?

A WAF may block known exploit payloads as virtual patching, but it is not a substitute for the official patch. OS command injection exploits can be obfuscated in hundreds of ways — URL encoding, alternate character sets, HTTP header injection — that bypass generic WAF rules. Additionally, CVE-2026-34635 (the hard-coded crypto key flaw) is not a network-reachable attack and would be unaffected by a WAF. Apply the patch; use the WAF as a defence-in-depth layer, not your primary control.

Are ColdFusion versions older than 2023 affected?

Adobe only patches supported versions — currently ColdFusion 2023 and 2025. ColdFusion 2021 reached end-of-life in November 2024 and will not receive APSB26-90 patches. If your organisation still runs ColdFusion 2021 or earlier, you should treat these servers as fully compromised until they are either migrated to a supported version or isolated entirely from internet exposure. ColdFusion 2021 and earlier versions are equally or more likely to contain the same underlying flaws.

How do I verify my ColdFusion version and confirm the patch is applied?

Log in to the ColdFusion Administrator panel (/CFIDE/administrator/), navigate to Server Settings > Version Information. You should see ColdFusion 2025.0.12 or ColdFusion 2023.0.23. Alternatively, query the server via the ColdFusion API or check the neo-runtime.xml configuration file for the build number. After patching, Adobe recommends running the official APSB26-90 installation verification steps detailed in the security bulletin.

---

Sources: Adobe Security Bulletin APSB26-90 · NVD CVE-2026-48362 · The Hacker News · SecurityWeek · Field Effect