CISA Adds Critical Adobe ColdFusion RCE Flaw to Known Exploited Vulnerabilities List

On July 8, 2026, CISA added four high-severity vulnerabilities to its Known Exploited Vulnerabilities catalog, including a maximum-severity flaw in Adobe ColdFusion rated CVSS 10.0. The ColdFusion vulnerability, tracked as CVE-2026-48282, involves a path traversal weakness that allows unauthenticated attackers to execute remote code without any credentials. Federal agencies are required to patch the listed flaws within mandated timelines, giving the KEV designation significant regulatory weight across critical infrastructure sectors. The affected systems span healthcare, financial services, and government environments where ColdFusion handles sensitive data such as database credentials and API keys. The remaining three catalogued flaws target authentication boundaries, and analysts note that adversaries are increasingly chaining vulnerabilities across diverse platforms including Joomla and Langflow to build multi-stage exploitation paths.