CISA Adds Adobe ColdFusion Path Traversal Vulnerability to KEV List

## Overview CISA has added CVE-2026-48282 to its Known Exploited Vulnerabilities (KEV) list. This vulnerability affects Adobe ColdFusion versions 2025.9, 2023.20, and earlier. It allows for path traversal, which can lead to arbitrary code execution without user interaction. The addition to the KEV list indicates a federal deadline for remediation. ## Technical Details The vulnerability arises from an improper limitation of a pathname to a restricted directory. Attackers can exploit this flaw to access files outside the intended directory. The exploitation does not require any user interaction, making it particularly dangerous. Affected systems may be compromised by simply accessing a malicious URL. ## Impact Successful exploitation of CVE-2026-48282 can result in arbitrary code execution in the context of the current user. This could allow attackers to manipulate data, install malware, or further penetrate the network. Given the CVSS score of 10.0, this vulnerability poses a critical risk to organizations using affected versions of ColdFusion. ## Mitigation Defenders should prioritize patching affected ColdFusion versions. Adobe has released updates to address this vulnerability. Organizations must apply patches as soon as possible to mitigate the risk of exploitation. Regularly review security practices and ensure that systems are monitored for unusual activity.