Adobe wants you to believe the story behind this week’s Adobe ColdFusion vulnerabilities is speed: attackers moving from disclosure to exploitation in hours instead of days, an arms race the defenders are losing. That framing is convenient for Adobe. It’s also only half true. The more useful story is simpler. A widely deployed enterprise platform still ships an unauthenticated file upload endpoint by default in 2026. That’s a design failure, not a speed problem.
The bug that got exploited fast wasn’t exotic
CVE-2026-48282 is a path traversal flaw. It needs no authentication and hands an attacker code execution. Ryan Dewhurst of KEVIntel caught it being exploited within hours of disclosure. Adobe has since confirmed “limited attacks” in its own bulletin. That’s a serious bug, but path traversal leading to code execution is not a novel attack class. It’s one of the oldest categories in the book. It survived into a 2026 ColdFusion release, in a build current enough to still be receiving updates. That says more about the platform’s engineering priorities than about attacker sophistication.
Eleven Adobe ColdFusion vulnerabilities, one connector, no login required
Look past the headline CVE and the pattern gets worse. CVE-2026-48283 and CVE-2026-48313, detailed in Horizon3.ai’s research, chain an unauthenticated file upload with a path traversal bug. Both live in the CKEditor file manager connector that ships with ColdFusion out of the box. An attacker with no credentials can write a file where it shouldn’t go, then run it as the ColdFusion service account. It’s the same shape of flaw that turned Splunk’s PostgreSQL sidecar into an open door for an unauthenticated attacker to write files and pivot to remote code execution last month. Eleven flaws landed in one bulletin, several rated a maximum CVSS score, several needing zero authentication. That’s not one team’s bad Tuesday. That’s a pattern across a product line, on a connector that has been a known soft spot for years.
Shipping a file manager component that talks to the filesystem without checking who’s asking, then patching it a decade into the product’s life, is the actual defect here. Attackers exploiting it quickly is just attackers doing their job.
“AI-driven vulnerability discovery” is doing a lot of work in that sentence
Adobe told SecurityWeek it’s moving ColdFusion to twice-monthly bulletins because the gap between disclosure and exploitation is compressing for flaws like these Adobe ColdFusion vulnerabilities. The company cites accelerated, AI-assisted vulnerability hunting as a driver. Maybe that’s part of it. But faster bug-hunting tools finding old, unauthenticated file-handling flaws doesn’t excuse the flaws existing. If anything, it’s an argument for shipping secure defaults in the first place. The population of people who can find your weak spots just got a lot bigger and a lot faster. A twice-monthly bulletin schedule treats the symptom. It doesn’t touch the underlying habit of leaving sensitive connectors reachable by default.
What this means if you’re the one holding the pager
None of this changes what you need to do about these Adobe ColdFusion vulnerabilities this week. Patch to ColdFusion 2025 Update 10 or 2023 Update 21. Check logs for exploitation of CVE-2026-48282 going back to 30 June. Lock down or test the CKEditor file manager connector against the other two bugs. But it should change how you think about the next ColdFusion bulletin, and the one after that. A twice-monthly cadence from Adobe is a tacit admission that the current baseline isn’t safe to leave alone between updates. Build your patch process around that reality rather than around Adobe’s promise to tell you sooner.
If you’re scoping a pen test or an attack surface review and ColdFusion shows up in the asset list, don’t wait for the next CVE to justify flagging it. The version history alone is the finding.
Vendors keep asking for trust they haven’t earned
There’s a broader habit on display here worth naming. A vendor ships a component with weak defaults. Researchers find the flaws years later. The vendor patches. It frames the disclosure-to-exploitation gap as an external threat trend rather than a consequence of its own design choices. Then it promises a faster bulletin cycle as the fix. Each step sounds reasonable in isolation. Together, they let the actual root cause, a file manager connector that never should have trusted an unauthenticated request, slide past without anyone having to answer for it.
None of that is unique to Adobe. It’s the standard shape of enterprise software vulnerability disclosure, and these Adobe ColdFusion vulnerabilities have just handed us a clean, well-documented example of it happening in real time. A named researcher tracked the exploitation clock. A vendor bulletin got updated mid-week to catch up.
Treat the patch as the minimum, not the resolution. The resolution is asking harder questions before the next connector like this one ships enabled by default. That means procurement teams should ask vendors what’s reachable without a login before signing a renewal. It means security teams should push back when the answer is “everything, but it’s fine because nobody’s found a bug yet.” This week, ColdFusion is the example. Next quarter it will be some other platform with the same problem. That will keep happening until buyers start treating unauthenticated-by-default as a red flag instead of a footnote.
