Adobe ColdFusion Gets Second July Patch Wave: 8 Critical CVEs Including CVE-2026-48318 Path Traversal (CVSS 9.9)

Adobe issued a new Priority 1 ColdFusion security advisory on July 14, 2026 — the second time in two weeks it has patched the same product at Priority 1 severity. This batch resolves 13 ColdFusion vulnerabilities, eight of which are rated Critical: the lead CVE-2026-48318 is a path traversal flaw scoring CVSS 9.9 that can lead to arbitrary code execution, accompanied by code injection, improper input validation, missing authentication, SQL injection, and incorrect authorization bugs. Fixed versions are ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22. Adobe says it is not aware of active exploitation at time of disclosure — but the prior ColdFusion advisory was exploited within hours of release, making speed critical.

What the Vulnerabilities Are

Adobe's July 14 advisory introduces a second batch of critical ColdFusion CVEs entirely distinct from the APSB26-68 batch patched July 1. The eight critical issues span multiple vulnerability classes:

CVE-2026-48318 (CVSS 9.9) is the headline bug. Path traversal vulnerabilities in ColdFusion have a particularly dangerous history — CVE-2026-48282 from the previous advisory (APSB26-68) was exactly this class and was exploited in the wild within hours of public disclosure, reading Windows system files from internet-exposed ColdFusion servers. CVE-2026-48318 is a fresh traversal flaw distinct from that CVE but in the same product and product area.

The five remaining (non-critical) vulnerabilities in this advisory are rated Important and are addressed by the same ColdFusion 2025 Update 11 / 2023 Update 22 patch.

Why It Matters

• ColdFusion servers are a high-value target. They typically run in enterprise environments handling e-commerce, government portals, financial systems, and healthcare applications. A single compromised ColdFusion server often means access to sensitive databases and connected systems.
• The prior advisory was weaponized within hours of disclosure. APSB26-68's CVE-2026-48282 (a path traversal rated CVSS 10.0) was added to CISA's Known Exploited Vulnerabilities catalog and saw automated exploitation attempts the same day it was published. Attackers actively monitor Adobe advisories.
• Two rounds of Priority 1 patches in two weeks means the attack surface isn't fully closed. Running Update 10 / Update 21 (the previous patch) is no longer sufficient. Only Update 11 / Update 22 addresses this new batch.
• Priority 1 is Adobe's highest urgency tier. Adobe urges patching within 72 hours for Priority 1 advisories.

Am I Affected?

You are affected if you run on-premises ColdFusion on any platform and have not yet applied:

• ColdFusion 2025: You are affected if your version is below Update 11
• ColdFusion 2023: You are affected if your version is below Update 22

To check your current update level, log into the ColdFusion Administrator and go to Server Update → Updates → Settings.

Note: ColdFusion 2021 reached end of extended support in November 2025 and receives no patches for this advisory. If you are still on ColdFusion 2021, migration to a supported version is urgent.

What to Do About It: Step-by-Step

1. Check your ColdFusion version: Log in to the ColdFusion Administrator (typically at /CFIDE/administrator/) and navigate to Server Update → Updates → Installed Updates. Note the current update number.
2. Apply the patch:
   • ColdFusion 2025: Install Update 11
   • ColdFusion 2023: Install Update 22
   From the ColdFusion Administrator, go to Server Update → Updates → Available Updates, select the update, and click Download and Install.
3. Restart the ColdFusion application server after patching:

   # Linux (service name may vary):
   sudo systemctl restart coldfusion
   
   # Windows:
   net stop "ColdFusion 2025 Application Server"
   net start "ColdFusion 2025 Application Server"

4. Harden ColdFusion if you haven't already (these reduce attack surface but do not substitute for patching):
   • Restrict /CFIDE/ access to admin IPs only via your web server/WAF. Add to NGINX config:

     location /CFIDE/ {
         allow 192.168.1.0/24;  # replace with your admin IP range
         deny all;
     }

   • Block direct internet access to the ColdFusion Administrator port (9000/8500 depending on configuration).
   • Enable your WAF's path traversal rules (e.g., ModSecurity CRS rule group REQUEST-930-APPLICATION-ATTACK-LFI).
5. Check for signs of exploitation (based on the prior advisory's attack pattern):

   # Check ColdFusion access logs for path traversal attempts:
   grep -E "\.\./|\.\.\\|%2e%2e|%252e%252e" /var/log/coldfusion/access.log
   
   # Look for suspicious CFM files written to the webroot recently:
   find /opt/coldfusion/cfusion/wwwroot -name "*.cfm" -mtime -7

Quick-Win Checklist

• Logged into ColdFusion Administrator and confirmed current update version
• Applied ColdFusion 2025 Update 11 or ColdFusion 2023 Update 22 immediately
• Restarted ColdFusion application server after patching
• Blocked /CFIDE/ and admin ports from public internet access
• Enabled WAF path traversal rules
• Audited ColdFusion webroot for unexpected .cfm files added in the last 7 days
• Verified you are NOT on ColdFusion 2021 (EOL — no patches)
• Subscribed to Adobe security bulletins: helpx.adobe.com/security/security-bulletin.html

Sources

• SecurityWeek — Adobe Patches Critical ColdFusion Vulnerabilities (July 14, 2026)
• The Hacker News — Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws (July 2026)
• Adobe Security Bulletins