Adobe ColdFusion CVE-2026-48282 — RDS FILEIO Path Traversal → Unauthenticated RCE

CVE-2026-48282 is a CVSS 10.0 path-traversal flaw in Adobe ColdFusion's Remote Development Services (RDS) FILEIO handler. An unauthenticated attacker sends a crafted RDS FILEIO WRITE request to /CFIDE/main/ide.cfm?ACTION=FILEIO and writes an arbitrary file — including a .cfm webshell — anywhere on disk, including the web root. The result is unauthenticated remote code execution as the ColdFusion service account.

Exploitation is realistic only where RDS is enabled and its authentication is disabled (not the ColdFusion default), but that misconfiguration is common on developer-adjacent and legacy CF servers. KEVIntel's honeypot network observed in-the-wild exploitation within roughly two hours of public disclosure on 2026-07-02, with early attacks from 103.207.14.220. The flaw is in CISA KEV.

The attacker's objective is a persistent web foothold. The highest-value defensive angle is process ancestry: the ColdFusion JVM (coldfusion.exe / java.exe under the CF service, or jrun) should almost never spawn cmd.exe, powershell.exe, /bin/sh, certutil, curl or whoami. Pair that with detection of newly written .cfm/.cfc/.cfml/.jsp files under web-servable ColdFusion paths.

Defender priority: Patch to ColdFusion 2025 Update 10 / 2023 Update 21 and disable RDS in production now. Until patched, hunt for ColdFusion-JVM child processes (Q1/Q5) and webshell writes under wwwroot\CFIDE / cfusion\wwwroot / cf_scripts (Q2) — these fire even when the exploiting request itself was not logged.

Web-hunter note: No malware hashes or additional attacker infrastructure have been published beyond the single scanner IP. This pack is therefore behavior-led — atomic IOCs are limited to 103.207.14.220 (perishable, hunt-only). Do not enrich with unattributed indicators.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A ColdFusion JVM process (coldfusion.exe/java.exe/jrun.exe) spawns a shell or LOLBin — the post-exploitation command-execution signal. Very low FP on a web tier.
2. H2 (high): A new .cfm/.cfc/.cfml/.jsp file is written under a ColdFusion web-servable path by the CF process — the dropped webshell.
3. H3 (high): ColdFusion JVM spawns powershell.exe with encoded/obfuscated arguments (-enc, FromBase64String, hidden window).
4. H4 (medium): ColdFusion JVM initiates outbound network connections to download second-stage tooling, or any host connects to the known scanner IP.
5. H5 (medium): Web/proxy logs show POST requests to /CFIDE/main/ide.cfm carrying ACTION=FILEIO — the exploitation request itself (requires web-log ingest).
6. H6 (medium): Reconnaissance discovery commands (whoami, net, ipconfig, systeminfo) executed by CF-spawned shells shortly after a webshell write.

Attack chain

Provenance note: Only one atomic network IOC has been published (a honeypot-observed scanner). No file hashes or C2 domains are available. Treat the IP as hunt/enrich, not a standalone block — it is a scanning source and highly perishable.

• ColdFusion Administrator log review: In cfusion\logs\rdsservice.log and exception.log, look for unexpected RDS FILEIO activity and file-write exceptions to web-servable paths.
• Web server access logs (IIS/Apache/nginx): Filter for POST to /CFIDE/main/ide.cfm with query string containing ACTION=FILEIO, and any subsequent GETs to non-standard .cfm files with a cmd= parameter.
• File integrity monitoring: Enumerate .cfm/.cfc/.cfml/.jsp files under the web root modified after 2026-07-01 that are not part of the application build manifest.
• ColdFusion config: Confirm whether RDS is enabled and whether RDS authentication (a required RDS password) is configured — a disabled-auth RDS is the exploit precondition.

Promote Q1 and Q3 to blocking Custom IOAs first — both are near-zero FP on a web tier. Keep Q2 as detect-only until the deploy-account exclusion is confirmed.

Only one published atomic indicator exists (a perishable scanner IP). Hashes/C2 are REPLACE_WITH_... placeholders — fill only from your own confirmed findings, never from unattributed feeds.

type,value,action,severity,expiration,description,tags
ipv4,103.207.14.220,detect,high,2026-08-08,CVE-2026-48282 early exploitation scanner,campaign:ColdFusion-RDS-FILEIO
sha256,REPLACE_WITH_WEBSHELL_SHA256,detect,high,2027-01-08,CF webshell (confirm locally),campaign:ColdFusion-RDS-FILEIO
domain,REPLACE_WITH_C2_DOMAIN,detect,high,2026-10-08,CF second-stage C2 (confirm locally),campaign:ColdFusion-RDS-FILEIO

Parent(coldfusion|jrun|java svc) -> Child(cmd|powershell|sh|certutil|curl|wget|whoami)
FileWrite(*.cfm|*.cfc|*.jsp) under wwwroot|CFIDE|cf_scripts by CF JVM
PowerShell(-enc|FromBase64String|-w hidden) with CF parent
POST /CFIDE/main/ide.cfm?ACTION=FILEIO from non-developer source

CVE: CVE-2026-48282 (CVSS 10.0)
Component: ColdFusion Remote Development Services (RDS) FILEIO handler
Endpoint: /CFIDE/main/ide.cfm?ACTION=FILEIO  (POST, application/octet-stream)
Precondition: RDS enabled AND RDS authentication disabled
Webshell ext: .cfm .cfml .cfc .jsp .jspx

Fixed: ColdFusion 2025 Update 10  |  ColdFusion 2023 Update 21
Vulnerable: 2025 Update 9 and earlier (2025.9); 2023 Update 20 and earlier (2023.20)
Audit: is RDS enabled?  is an RDS password set?  is /CFIDE reachable externally?
Action: patch, disable RDS in prod, block /CFIDE at the proxy

1 · Windows — check ColdFusion exposure (PowerShell)

# Find ColdFusion install + version, and recently-modified webshell candidates
Get-ChildItem 'C:\ColdFusion*','C:\inetpub' -Recurse -Include *.cfm,*.cfc,*.cfml,*.jsp -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date '2026-07-01') } |
  Select-Object FullName,LastWriteTime,Length | Sort-Object LastWriteTime -Descending

# Is RDS reachable locally? (expects 403/redirect once locked down)
Invoke-WebRequest -UseBasicParsing -Uri 'http://localhost:8500/CFIDE/main/ide.cfm' -Method Head -ErrorAction SilentlyContinue |
  Select-Object StatusCode

2 · IIS / reverse proxy — block the RDS endpoint

# IIS URL Rewrite (web.config) — deny the vulnerable RDS handler
<rule name="Block-CF-RDS-FILEIO" stopProcessing="true">
  <match url="CFIDE/main/ide\.cfm" />
  <action type="AbortRequest" />
</rule>

# nginx equivalent
location ~* /CFIDE/main/ide\.cfm { return 403; }
location ~* /CFIDE/ { allow 10.0.0.0/8; deny all; }

3 · Linux — locate recently written webshells

# CF service tree recently-written server-side scripts (review each hit)
find /opt/coldfusion* /var/www -type f \( -name '*.cfm' -o -name '*.cfc' -o -name '*.jsp' \) -newermt '2026-07-01' -printf '%TY-%Tm-%Td %p\n' 2>/dev/null | sort

Known gaps: The exploitation request (T1190) is only visible where HTTP access logs are ingested into NGSIEM — on hosts without web-log ingest, rely on the post-exploitation signals (Q1–Q3). No atomic file/domain IOCs are published, so IOC-based blocking is limited to the single perishable scanner IP.