What Happened
CISA issued an emergency directive under Binding Operational Directive 26-04 on July 9, 2026, ordering all US federal civilian executive branch agencies to patch Adobe ColdFusion vulnerability CVE-2026-48282 by Friday, July 10. The flaw carries a CVSS score of 10.0 — the maximum — and was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on July 7 after active exploitation was confirmed within hours of public disclosure.
CVE-2026-48282 is a path traversal vulnerability in Adobe ColdFusion that enables unauthenticated remote attackers to execute arbitrary code on affected servers. The flaw affects ColdFusion 2025.9, 2023.20, and all earlier versions in both product lines. Adobe released patches as part of its July 2026 security update cycle. Exploitation was observed from an IP address geolocated to India, with at least one confirmed attempt recorded in the immediate aftermath of disclosure. Full details are reported by BleepingComputer.
Why This Matters for Canadian Organizations
Adobe ColdFusion has a long deployment history in Canadian federal government systems, provincial web portals, post-secondary institutions, and legacy enterprise environments. Unlike modern application frameworks, ColdFusion installations are often embedded in aging infrastructure where update cycles are slow and internet-facing exposure is common. A CVSS 10.0 unauthenticated RCE flaw on a publicly accessible ColdFusion server is a complete compromise — an attacker with network access needs no credentials to take over the host.
CISA’s BOD 26-04 imposes a 3-day remediation window on US federal agencies for vulnerabilities in this class. While the directive does not bind Canadian federal departments, the Canadian Centre for Cyber Security (CCCS) tracks CISA KEV additions closely and issues its own guidance aligned to US federal timelines. Organizations operating under OSFI B-13 or subject to PIPEDA data breach obligations have independent obligations to patch actively exploited vulnerabilities in a risk-appropriate timeframe — a CVSS 10.0 flaw with confirmed exploitation leaves no room for delay.
Any Canadian organization with an internet-accessible ColdFusion server that has not applied Adobe’s July 2026 patches should treat this as an emergency. The ColdFusion attack surface is well understood by attackers, and a working exploit for a prior ColdFusion flaw (CVE-2026-48282’s predecessor in the July 1 patch set) was already in circulation — threat actors have demonstrated both the tooling and the intent to move fast against ColdFusion targets.
What to Do
Apply Adobe’s July 2026 ColdFusion patches immediately. If patching is not feasible within hours, block all external access to ColdFusion administration interfaces and restrict inbound HTTP/HTTPS to known IP ranges while a maintenance window is arranged. Audit your ColdFusion deployments — including development and test environments — for internet exposure using Shodan or similar tooling. Review web server logs for path traversal patterns (sequences involving encoded slashes and dot-dot notation) dating back to July 7. If you find evidence of exploitation, initiate your incident response process, preserve forensic artifacts, and notify your legal team to begin the PIPEDA breach assessment clock. Report confirmed exploitation to the CCCS through its cyber incident reporting portal.
