CVE-2026-48282: listed in the CISA KEV catalog

CVE-2026-48282 · CVSS 10.0 CRITICAL · KEV 2026-07-07

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Is CVE-2026-48282 exploited?

• Listed in the CISA KEV catalog on 2026-07-07.
• Federal remediation due 2026-07-10.
• Past that date by 36 days.
• Public exploit code: none found in monitored sources.
• Public detection rules exist.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2026-48282

• ColdFusion Exposure Window Collapses to Hours (2026-07-06)
• ColdFusion Input Bugs Reach Code Execution Again (2026-07-02)

Primary sources

• NVD record
• CISA KEV catalog
• Nuclei template

What this record does not say

• No EPSS score.
• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.