Adobe has released an emergency security bulletin, APSB26-68, addressing 11 vulnerabilities in Adobe ColdFusion 2025 and ColdFusion 2023, with multiple vulnerabilities receiving the maximum CVSS base score of 10.0.
Published on June 30, 2026, this bulletin carries Adobe’s highest Priority Rating of 1, indicating that these vulnerabilities are either actively targeted or pose an extremely high risk of exploitation.
Adobe strongly urges all affected users to apply the available patches immediately. However, the company has stated that it is currently unaware of any in-the-wild exploitation of these issues.
Adobe ColdFusion Critical Vulnerabilities
The impact of these vulnerabilities is broad and severe. They can lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass, effectively granting a remote, unauthenticated attacker complete control over a vulnerable ColdFusion server.
Affected versions include ColdFusion 2025 Update 9 and all earlier versions, as well as ColdFusion 2023 Update 20 and all earlier versions across all supported platforms. Adobe has resolved these issues in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21, both of which are now available for download.
Among the most critical flaws are six vulnerabilities with a maximum CVSS score of 10.0. These include CVE-2026-48276 and CVE-2026-48283, both caused by unrestricted file uploads (CWE-434), which allow unauthenticated remote attackers to upload and execute arbitrary files on the server.
Three instances of improper input validation (CWE-20), tracked as CVE-2026-48277, CVE-2026-48281, and CVE-2026-48316, also enable full arbitrary code execution without requiring authentication or user interaction. A critical Path Traversal flaw (CVE-2026-48282, CWE-22) further contributes to the CVSS 10.0 score, allowing remote code execution.
In addition to the perfect-score vulnerabilities, several other critical-severity flaws increase the attack surface. CVE-2026-48313 (Improper Input Validation, CVSS 9.3) enables privilege escalation.
At the same time, CVE-2026-48307 (Server-Side Request Forgery/SSRF, CWE-918, CVSS 8.6) allows unauthorized outbound server-side requests, leading to security feature bypass. A reflected cross-site scripting vulnerability (CVE-2026-48315, CWE-79, CVSS 8.8) also enables arbitrary code execution via adjacent network access.
Another Path Traversal flaw (CVE-2026-48314, CWE-22, CVSS 6.5), rated Important, allows privilege escalation through improper directory restriction.
Independent security researchers responsibly disclosed these vulnerabilities. Anirudh Anand (a0xnirudh) was credited for reporting CVE-2026-48283 and CVE-2026-48313.
At the same time, Matan Sandori (matans1) and 2Bsecure were acknowledged for reporting CVE-2026-48307 through Adobe’s public bug bounty program on HackerOne.
Adobe also recommends that ColdFusion administrators update to the latest MySQL Java Connector and review the updated serial filter documentation to strengthen defenses against insecure deserialization attacks.
Given the widespread use of Adobe ColdFusion for building and serving web applications, these vulnerabilities represent a critical attack vector for threat actors.
Organizations running ColdFusion in internet-exposed environments should treat this as a Priority 1 patch and deploy Update 10 (ColdFusion 2025) or Update 21 (ColdFusion 2023) without delay to eliminate the risk of server compromise.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
