Threat actors have started exploiting a critical Adobe ColdFusion security issue listed as CVE-2026-48282, based on information from the vulnerability intelligence provider KEVIntel.

The ColdFusion platform serves as a commercial tool for developing web applications, aiding in the creation and deployment of enterprise-level websites. This CVE-2026-48282 weakness impacts ColdFusion versions 2025.9, 2023.20, and prior releases, allowing unauthenticated attackers to achieve remote code execution on systems lacking updates.

On Tuesday, Adobe issued patches for the flaw, highlighting the elevated chance of exploitation and advising immediate application of the fixes by administrators.

"The patch addresses security issues currently under attack or facing elevated exploitation risks for specific product versions and platforms," Adobe stated. "Administrators should apply the update promptly, ideally within 72 hours."

KEVIntel founder Ryan Dewhurst alerted that malicious actors started using CVE-2026-48282 just two hours after Adobe made the details public.

"KEVIntel detected real-world exploitation in our worldwide honeypot network less than two hours after public information on CVE-2026-48282 became available," Dewhurst noted.

The Canadian Centre for Cyber Security (CCCS), responsible for coordinating Canada's national cybersecurity incident response, has also called on defenders to protect their systems from the ongoing threats.

"Reports from open sources show exploitation of CVE-2026-48282," the CCCS stated. "The Cyber Centre advises users and administrators to examine the referenced resources and implement required patches."

Shadowserver, an internet security monitoring organization, currently observes almost 800 Adobe ColdFusion servers visible online, though details remain unclear regarding how many represent honeypots or have received protections against CVE-2026-48282 attacks.

Adobe distributed fixes last week for six critical vulnerabilities affecting the ColdFusion development platform and Campaign Classic automation tool, all susceptible to straightforward attacks without needing user interaction and carrying high exploitation potential.

The firm has not identified any as actively exploited so far, indicating it "is not aware of any exploits in the wild for any of the issues addressed in these updates."

Adobe provided urgent patches in early April for an Acrobat Reader flaw (CVE-2026-34621) that saw zero-day exploitation spanning at least four months beginning in December 2025.

From November 2021 onward, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed 79 Adobe product vulnerabilities in its actively exploited catalog, with 10 also involved in ransomware campaigns.

Update July 06, 10:24 EDT: Attribution for the initial wild exploitation report updated to KEVIntel's Ryan Dewhurst.