A path traversal in Adobe ColdFusion (CVE-2026-48282) — what it means for one product to appear in KEV sixteen times
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. CISA added it to the KEV catalog on 2026-07-07 with a due date of 2026-07-10 — three days. This is the sixteenth time ColdFusion has appeared in KEV.
Key facts
- CVE IDCVE-2026-48282
- Affected (vendor / product)Adobe ColdFusion
- CWECWE-22
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-07-10 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is Adobe ColdFusion; CWE-22, improper limitation of a pathname, leading to arbitrary code execution in the context of the current user.
- Added to KEV 2026-07-07 with a due date of 2026-07-10 — three days. The required action includes BOD 26-04 and the Forensics Triage Requirements.
- This is the sixteenth ColdFusion entry in KEV; the oldest was added in November 2021, and CVEs assigned in 2013 and 2010 are among them.
- Grouping the 1,685 records this site holds as of 2026-08-28 by product yields 708 distinct products, of which 225 (31.8 percent) appear more than once.
- Records belonging to those repeat products number 1,202 — 71.3 percent of all records.
- Grouping the 1,685 records by product gives 708 kinds; the 225 appearing more than once hold 71.3 percent of records.
1How a path traversal becomes code execution
Path traversal is a flaw in which the logic deciding where a file is read or written checks the given path inadequately, letting it escape the intended area. On a read it is a disclosure of information; where a write is possible, a file can be placed somewhere that gets executed. Configuration files, scripts read at startup, directories a web application serves.
Depending on where writing can land, plain file manipulation turns into arbitrary code execution.
2Counting to sixteen
Counting KEV records whose product is ColdFusion, this site holds 16 including this one. The oldest was added in November 2021, and CVEs assigned in 2013 and 2010 are among them. A particular product appearing on the ledger repeatedly is the flip side of that product being widely used and worth an attacker time. The fact that the same name keeps recurring is something no single entry can ever show.
3Repeat products account for 71 percent of records
This is not peculiar to ColdFusion. Grouping the 1,685 records this site holds as of 2026-08-28 by product yields 708 distinct products, of which 225 — 31.8 percent — appear more than once. The records belonging to those repeat products number 1,202, or 71.3 percent of all records. At the top are Microsoft Windows with 172, Apple Multiple Products with 53, and Google Chromium V8 with 39.
Exploited vulnerabilities do not spread evenly across new products; they pile up on the same ones.
Why it matters
Working through vulnerabilities one at a time makes it hard to notice that the same product keeps reappearing. That 71.3 percent of records belong to repeat products argues for taking inventory by product and looking at how often each has been listed before. A three-day deadline separates organizations that have done that preparation from those that have not.
FAQ
Why does path traversal become code execution?
Is one product recurring unusual?
Why do certain products dominate?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).