Skip to content
Sign in

Adobe product

ColdFusion

Alert
No CISA KEV deadline is open. CISA last added a ColdFusion CVE on 7 Jul.

Tracked since 15 Apr · latest article 13 Jul · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 16 in the full CISA catalogue · all time

1High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date16

ColdFusion CVEs in CISA KEV with their federal deadlines. None is open.

Exploited ColdFusion CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-48282ColdFusion7 JulPassed 10 Jul17
In CISA KEVCVE-2017-3066ColdFusion24 FebPassed 17 Mar–
In CISA KEVCVE-2024-20767ColdFusion16 DecPassed 6 Jan–
In CISA KEVCVE-2023-29300RansomwareColdFusion8 JanPassed 29 Jan–
In CISA KEVCVE-2023-38203RansomwareColdFusion8 JanPassed 29 Jan–
In CISA KEVCVE-2023-26359ColdFusion21 AugPassed 11 Sep–
Show 10 moreVendor CSV of 83 entries for AdobeAll 83 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds ColdFusion CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

1Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’260Q2 ’261Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20251
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20261
Q4 20260

Fix listed

10 of 10 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-48282: 98.7th percentile, in CISA KEVCVE-2026-27305: 98th percentileCVE-2026-34619: 94.5th percentileCVE-2026-27304: 89.5th percentileCVE-2026-48313: 87.1th percentileCVE-2026-48281: 72.7th percentileCVE-2026-48277: 70.1th percentileCVE-2026-48283: 69.5th percentileCVE-2026-48276: 69.5th percentileCVE-2026-27282: 52.7th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-4828298.7
CVE-2026-2730598
CVE-2026-3461994.5
CVE-2026-2730489.5
CVE-2026-4831387.1
CVE-2026-4828172.7
CVE-2026-4827770.1
CVE-2026-4828369.5
CVE-2026-4827669.5
CVE-2026-2728252.7

Coverage19 articles · all time

The latest 19 articles naming ColdFusion, in the shared story grammar.

Full timeline
Quiet for 15 weekslast report 13 Jul19 articles6 outlets

19 articles from 6 outlets since 15 Apr. Quiet since 13 Jul.

Now15 Apr30 Jun3579111315First reportThe Hacker News · 15 Apr, 14:04CISA alert7 Jul, 19:21 · officialExploited CVESecurityOnline · 3 Jul
  • Wed 15 Apr, 14:04 UTC. The Hacker News, first report. Exploiters target SAP SQLi and Adobe zero day flaws in April.
  • Wed 1 Jul, 11:51 UTC. SecurityWeek, its first report on the story. Adobe fixes ColdFusion Campaign Classic bugs, urges patch.
  • Thu 2 Jul, 10:33 UTC. Security Affairs, its first report on the story. Adobe Fixes ColdFusion, Campaign Classic Bugs Rated CVSS 10.0.
  • Fri 3 Jul, 05:31 UTC. SecurityOnline, its first report on the story. Active ColdFusion Arbitrary Code Execution Flaw Scores CVSS 10. Cites a CVE in CISA KEV.
  • Mon 6 Jul, 02:32 UTC. SecurityOnline. Weekly Threat Intelligence: The July 2026 Breaches. Cites a CVE in CISA KEV.
  • Mon 6 Jul, 20:31 UTC. Security Affairs. Attackers hit Adobe ColdFusion via CVE-2026-48282 within hours. Cites a CVE in CISA KEV.
  • Tue 7 Jul, 08:56 UTC. Infosecurity, its first report on the story. Adobe ColdFusion Users Warned to Patch Critical CVE-2026-48282 Flaw. Cites a CVE in CISA KEV.
  • Tue 7 Jul, 12:58 UTC. SecurityWeek. Adobe ColdFusion flaw CVE-2026-48282 exploited hours after patch. Cites a CVE in CISA KEV.
  • Tue 7 Jul, 19:21 UTC. CISA, its first report on the story. CISA Adds Critical Adobe ColdFusion Flaw CVE-2026-48282 to KEV. Cites a CVE in CISA KEV.
  • Tue 7 Jul, 22:31 UTC. CISA. CISA KEV Catalog Flags Adobe ColdFusion CVE-2026-48282 Exploit. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 03:31 UTC. SecurityOnline. CISA flags critical Joomla, ColdFusion bugs under attack. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 03:31 UTC. SecurityOnline. Four flaws hit Joomla, Langflow, ColdFusion and Linux today. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 09:21 UTC. Security Affairs. CISA warns of active exploits in ColdFusion, Joomla page builders. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 10:01 UTC. SecurityOnline. Android Remote Root Exploit Chain Unveiled by Nebula. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 11:08 UTC. SecurityWeek. CISA alerts on critical ColdFusion Langflow and Joomla flaws. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 17:08 UTC. SecurityOnline. Foxit PDF Reader flaws expose users to arbitrary code execution. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 17:12 UTC. SecurityOnline. Network UPS Tools RCE Flaw Affects upsmon, With No Patch Yet. Cites a CVE in CISA KEV.
  • Thu 9 Jul, 05:32 UTC. SecurityOnline. LineageOS Browser Flash Tool Makes ROM Install Easier. Cites a CVE in CISA KEV.
  • Mon 13 Jul, 03:01 UTC. SecurityOnline. CISA Adds Six KEV Flaws, Including Joomla Extensions and AI Bugs. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 19 articles as a list
  1. Wed 15 AprDay 01
    1. Exploiters target SAP SQLi and Adobe zero day flaws in April14:04 · The Hacker News · First report

  2. Quiet for 11 weeks

    Wed 1 JulDay 771
    1. Adobe fixes ColdFusion Campaign Classic bugs, urges patch11:51 · SecurityWeek · Picked up again
  3. Thu 2 JulDay 781
    1. Adobe Fixes ColdFusion, Campaign Classic Bugs Rated CVSS 10.010:33 · Security Affairs
  4. Fri 3 JulDay 791
    1. Active ColdFusion Arbitrary Code Execution Flaw Scores CVSS 1005:31 · SecurityOnline · Exploited CVE · Known exploited CVE

  5. Quiet for 3 days

    Mon 6 JulDay 822
    1. Weekly Threat Intelligence: The July 2026 Breaches02:32 · SecurityOnline · Picked up again · Known exploited CVE
    2. Attackers hit Adobe ColdFusion via CVE-2026-48282 within hours20:31 · Security Affairs · Known exploited CVE
  6. Tue 7 JulDay 834
    1. Adobe ColdFusion Users Warned to Patch Critical CVE-2026-48282 Flaw08:56 · Infosecurity · Known exploited CVE
    2. Adobe ColdFusion flaw CVE-2026-48282 exploited hours after patch12:58 · SecurityWeek · Known exploited CVE
    3. CISA Adds Critical Adobe ColdFusion Flaw CVE-2026-48282 to KEV19:21 · CISA · official · CISA alert · Known exploited CVE
    4. CISA KEV Catalog Flags Adobe ColdFusion CVE-2026-48282 Exploit22:31 · CISA · official · Known exploited CVE
  7. Wed 8 JulDay 847
    1. CISA flags critical Joomla, ColdFusion bugs under attack03:31 · SecurityOnline · Known exploited CVE
    2. Four flaws hit Joomla, Langflow, ColdFusion and Linux today03:31 · SecurityOnline · Known exploited CVE
    3. CISA warns of active exploits in ColdFusion, Joomla page builders09:21 · Security Affairs · Known exploited CVE
    Show 4 more from 8 Jul
    1. Android Remote Root Exploit Chain Unveiled by Nebula10:01 · SecurityOnline · Known exploited CVE
    2. CISA alerts on critical ColdFusion Langflow and Joomla flaws11:08 · SecurityWeek · Known exploited CVE
    3. Foxit PDF Reader flaws expose users to arbitrary code execution17:08 · SecurityOnline · Known exploited CVE
    4. Network UPS Tools RCE Flaw Affects upsmon, With No Patch Yet17:12 · SecurityOnline · Known exploited CVE
  8. Thu 9 JulDay 851
    1. LineageOS Browser Flash Tool Makes ROM Install Easier05:32 · SecurityOnline · Known exploited CVE

  9. Quiet for 4 days

    Mon 13 JulDay 891
    1. CISA Adds Six KEV Flaws, Including Joomla Extensions and AI Bugs03:01 · SecurityOnline · Picked up again · Known exploited CVE

All CVEs in coverage10

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-48282Exploited

    Adobe ColdFusion Path Traversal Vulnerability

    10.0Critical42% EPSS · 17 articles
  • CVE-2026-27305

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    8.6High26% EPSS · 1 article
  • CVE-2026-34619

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    7.7High7.6% EPSS · 1 article
  • CVE-2026-27304

    ColdFusion | Improper Input Validation (CWE-20)

    9.3Critical3.6% EPSS · 1 article
  • CVE-2026-48313

    Adobe ColdFusion 2025 vulnerability

    9.3Critical3.0% EPSS · 1 article
  • CVE-2026-48281

    ColdFusion | Improper Input Validation (CWE-20)

    10.0Critical1.4% EPSS · 1 article
  • CVE-2026-48277

    ColdFusion | Improper Input Validation (CWE-20)

    10.0Critical1.3% EPSS · 1 article
  • CVE-2026-48283

    ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

    10.0Critical1.3% EPSS · 2 articles
  • CVE-2026-48276

    ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

    10.0Critical1.3% EPSS · 2 articles
  • CVE-2026-27282

    ColdFusion | Improper Input Validation (CWE-20)

    7.5High0.7% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in