Developing2 outlets · over 19 hours
CISA orders patch for exploited ColdFusion flaw
CISA ordered U.S. federal agencies to patch a maximum-severity Adobe ColdFusion vulnerability, CVE-2026-48282, by June 10. The flaw affects ColdFusion versions 2025.9, 2023.20, and earlier, and is actively exploited in low-complexity remote attacks for code execution. Shadowserver tracks nearly 800 exposed ColdFusion instances online.
The story so far2 updates, latest first.
Tracked by ByteBrief