By Rey Bango & Brandon Peterson
Adobe ColdFusion has been a fixture in enterprise web application stacks for decades. The first version of the web application server was released in 1995, and I have to admit I had fond memories of building web apps using the product. I still love CFML (yes, I said it!). So you can imagine how Adobe’s latest security bulletin piqued my interest.
Apart from my past experience, government agencies, healthcare organizations, financial services firms, and higher education institutions have built and hosted dynamic web applications on it for years. That longevity is precisely what makes a pair of vulnerabilities worth paying close attention to.
CVE-2026-48283 and CVE-2026-48313 are two critical, unauthenticated vulnerabilities affecting Adobe ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier). Neither requires an attacker to have valid credentials or that a user clicks anything. And at least one of them results in remote code execution on the ColdFusion host.
When the Horizon3.ai Rapid Response team evaluated these vulnerabilities, NodeZero® was able to exploit CVE-2026-48283 and achieve host compromise in under 90 seconds. That result warrants a closer look at what these vulnerabilities actually are, how they work, and what defenders should do about them.
CVE-2026-48283: From File Upload to NT AUTHORITY\SYSTEM
Uploading files, like images, documents and such are par for the course in many web applications. It’s used for everything from updating your profile picture to sending over a copy of your resume when applying for a job. The main thing that is important is that your development and security teams consider the types of files that should be uploaded and implement proper sanitization capabilities to limit those to only what’s necessary. Otherwise, you run the risk of an attacker uploading a webshell that could let them take over the server.
Which leads us to CVE-2026-48283. This is a vulnerability that outlines a failure in ColdFusion’s file upload handling to properly restrict the types of files that can be submitted to the server. The vulnerability carries a CVSS score of 10.0, so you can understand that it has serious consequences when it appears in an internet-facing application.
Digging into the issue, an unauthenticated remote attacker can upload a malicious file to a ColdFusion server without any prior authentication and without any user interaction on the target side. ColdFusion includes the CKEditor filemanager connector, a server-side component that acts as a bridge between CKEditor’s file browser UI and your web server’s file system. It helps with tasks within the ColdFusion administration interface like file browsing and management. It was a feature added to ColdFusion around 2007 and continues to be a part of helping make administration easier for developers. I remember using it when I managed some ColdFusion servers and it was a marked user interface improvement over the Flash components.
Unfortunately, it also shipped an endpoint that allowed for unauthenticated file uploads:
/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm
The breakdown happened in ColdFusion’s file handling, which relied heavily on checking file extensions against disallowed lists. The parser failed to sanitize or validate specific file extensions or composite extensions before dropping the payload onto the file system. By default, .cfm,.cfc and .jsp are generally restricted on standard user uploads because these files tend to contain the code that powers your application. Unfortunately, some legacy server endpoints or internal RPC handling permitted alternative or unmapped executable types such as .jspf, .cfmail, or Java archive formats like .war. Yes, ColdFusion supports Java Server Pages and archive formats since it’s powered by a Java server under the hood. Of course, being able to upload files that contain code offers a new vector for uploading webshells.
So picture being able to upload a webshell that now gives you OS-level command control in the context of the ColdFusion service account. Yeah, that’s pretty bad, but wait, there’s more! It can get worse because, unless you’ve taken steps to change how the ColdFusion service account runs, it’ll generally be running within the context of NT AUTHORITY\SYSTEM!
What makes this vulnerability significant is its changed-scope rating. What this means is that successful exploitation can affect resources beyond the vulnerable component itself. Basically, once an attacker has code execution under the ColdFusion service account, it’s no longer “can they get in?” but “how far can they reach from there?” Remember that NT AUTHORITY\SYSTEM comment above? Yeah, bad.
If an attacker can run commands in the NT AUTHORITY\SYSTEM security context, for all intents, they control the host with no privilege escalation required. From there, the blast radius expands dramatically with an attacker being able to enumerate additional machines in a network, dump Kerberos tickets to request services as privileged users, and move laterally to other machines that could expose confidential and valuable customer information. Consider that every web application relies on a database server or connects to an API, not to mention that the source code for your application may contain credentials and token access keys that would allow for deeper access into your systems.
During Horizon3.ai’s Rapid Response testing, NodeZero exploited CVE-2026-48283 and confirmed host compromise in 1 minute and 27 seconds. This isn’t a vulnerability that requires a sophisticated attacker to run it. It’s the kind of issue that is low-hanging fruit for opportunistic threat actors to take advantage of quickly once a working exploit is available.
CVE-2026-48313: Not the Path You Want to Leave Unattended
The next ColdFusion nugget, CVE-2026-48313, is a path traversal issue that’s rated Critical with a CVSS score of 9.3. This vulnerability allows an unauthenticated attacker to read files outside the intended directory scope, including files located outside the web root. It also permits limited write operations outside the intended directory boundary. Hopefully, you’re starting to see where this is headed (think CVE-2026-48283).
As expected with path traversal vulnerabilities:
- There’s a failure to properly sanitize directory path inputs, allowing an attacker to navigate the file system beyond the scope the application intended.
- More specifically, the ColdFusion server filemanager connector component’s handling of file paths doesn’t properly prevent requests that step outside the permitted directory using relative path sequences.
In this case ColdFusion’s filemanager.cfc component, also a part of the CKEditor connector, is the culprit :
{}/ckeditor/plugins/filemanager/filemanager.cfc?method=getfmfiles&path=home/../../../../../../../WEB-INF/&_=1
Notice the {}. Importantly, the connector’s mount point can be overridden, so an attacker has to pull the _cf_ajaxscriptsrc JavaScript variable from the page source if it’s been changed from the default.
This allows an unauthenticated attacker to read sensitive files on the ColdFusion host. Putting on an attacker hat, configuration files are the first goto especially since ColdFusion environments frequently contain configuration files that store database credentials, API keys, and other sensitive values used by the applications running on the platform.
But Can You Chain Them?
Attackers like to think about vulnerabilities in chains, not just in isolation. When two unauthenticated vulnerabilities exist in the same product at the same time, one of the first questions worth asking is whether they can be used together to achieve something neither accomplishes alone.
In the case of CVE-2026-48283 and CVE-2026-48313, the mechanics suggest a plausible chaining scenario where an attacker could use the path traversal to read credential material and server configuration settings from ColdFusion configuration files and then leverage that information to facilitate or expand the impact of the file upload exploitation.
So even if the service isn’t running in the NT AUTHORITY\SYSTEM security context, if an attacker was able to grab credentials from config files using CVE-2026-48313, they could potentially use them to escalate privileges using CVE-2026-48283. This reinforces the “changed-scope rating” I mentioned before, since it can greatly expand the blast radius if the attacker was successful in getting credentials or access keys from the configuration files.
It is important to note that we haven’t validated a complete end-to-end chain between these two vulnerabilities in testing. The chaining scenario is technically plausible based on the vulnerability mechanics, but we are not asserting it as a confirmed exploit path. We wanted to provide a Rapid Response test that allowed defenders to prioritize patching on confirmed vulnerability exposure rather than waiting for proof of a combined attack.
What Horizon3.ai Found in Customer Environments
When we ran Rapid Response testing against customer environments for these vulnerabilities, no customer environments were found to have exploitable ColdFusion instances exposed to this attack.
It does not mean ColdFusion has disappeared from enterprise environments or that the risk from these CVEs is theoretical. What it does suggest is that ColdFusion’s footprint in the environments Horizon3.ai tests has contracted over time. This is consistent with broader industry trends as organizations have migrated away from the platform toward more modern web application frameworks.
For organizations that do run ColdFusion, particularly in government, healthcare, or financial services, where the platform has historically been common, these vulnerabilities represent exactly the kind of unauthenticated, externally reachable risk that should be managed post haste.
Remediation and Prioritization Guidance
Remediating these two vulnerabilities is fairly straightforward. Adobe has released patches addressing both vulnerabilities. The patches can be found in:
- ColdFusion 2025: Update 10
- ColdFusion 2023: Update 21
For organizations with internet-facing ColdFusion instances, the priority level here is “patch first, verify second”. Organizations running affected versions should apply these updates as the primary remediation path. For customers who are subscribed to our NodeZero Rapid Response service, a test is available to confirm whether your environment was or remains exposed.
If immediate patching isn’t feasible, the recommended interim measure from Adobe is to restrict network access to ColdFusion administration interfaces and file upload endpoints. Limiting exposure to trusted network segments reduces the attack surface while patch deployment is coordinated.
The compliance risks are real, based on the organization verticals that tend to use ColdFusion. Organizations subject to FISMA, HIPAA, PCI-DSS, or FedRAMP compliance requirements should note due to the criticality of these issues, these vulnerabilities may carry compliance implications beyond the operational security risk.
The Broader Point
CVE-2026-48283 and CVE-2026-48313 are a reminder that legacy platforms carry legacy risk. ColdFusion has been a productive target for attackers and the pattern of unauthenticated critical vulnerabilities in the platform is not new. Organizations that still rely on ColdFusion for active application hosting should be asking not just whether they are patched against these specific CVEs, but how well your ColdFusion inventory is being monitored.
Knowing you are patched is not the same as knowing you are not exploitable. Verification matters.
Learn More
Want to see how leading organizations are replacing assumptions with evidence? Join our upcoming webinar with Carahsoft to learn how autonomous security validation helps security teams identify exploitable attack paths, prioritize what truly matters, and continuously verify that remediation efforts have reduced real-world risk. Register today to reserve your spot: https://carahevents.carahsoft.com/Event/Register/781732-horizon3ai
Rey Bango is a Staff Vulnerability Analyst at Horizon3.ai and a longtime security practitioner, technologist, and communicator. Over the course of his career at organizations including Microsoft, Verizon, Veracode, and Horizon3.ai, he has helped advance application security, offensive security, developer communities, and cybersecurity education.