The Cybersecurity and Infrastructure Security Agency has directed federal agencies to apply patches for a top-severity security issue in Adobe ColdFusion by Friday. This flaw is currently being exploited in the wild.

Affected versions include ColdFusion 2025.9, 2023.20, and prior releases. Remote attackers can leverage this vulnerability without authentication in straightforward attacks to execute code on vulnerable machines.

Adobe issued fixes last week and advised immediate installation due to the elevated exploitation risk.

The update tackles issues that are either under active attack or carry a greater chance of targeting, according to Adobe. Officials recommend applying the patch promptly, ideally within 72 hours.

Shortly after the release, experts noted that exploitation attempts started within hours of the announcement. The Canadian Centre for Cyber Security also urged defenders to protect against these threats.

Shadowserver monitors around 800 publicly accessible ColdFusion servers, though details on their security status remain unclear.

CISA included the vulnerability in its known exploited list on Tuesday and set the patching deadline for federal agencies as Friday, June 10, per existing directives.

The directive emphasizes prioritizing patches for flaws in the KEV catalog, those enabling automated attacks, internet-exposed assets, and those granting significant control.

Adobe addressed six additional critical flaws in ColdFusion and Campaign Classic last week, all rated high risk, but none confirmed as exploited yet.

The firm stated it knows of no in-the-wild exploits for those other issues.

In April, Adobe provided urgent updates for an Acrobat Reader zero-day exploited since late 2025.

CISA has cataloged 80 Adobe vulnerabilities as actively exploited since late 2021, with 10 linked to ransomware campaigns.