Adobe ColdFusion: Active Exploit in 2 Hours, Critical Patch for…

CVE-2026-48282 in ColdFusion carries a maximum CVSS 10.0 score with in-the-wild exploitation detected within two hours. CCCS confirms offensive activity; Adobe patched July 7. KVM Januscape and BeyondTrust flaws also covered in the bulletin.

Adobe ColdFusion CVE-2026-48282 has reached the maximum CVSS score of 10.0 and is actively exploited in-the-wild. Exploitation began within two hours of the public release of technical details, according to KEVIntel detections. Adobe released patches on July 7, 2026, with an advisory to install within 72 hours for affected versions 2025.9, 2023.20, and earlier.

Key Takeaways

CVE-2026-48282 is a path traversal vulnerability with CVSS 10.0 that allows arbitrary file writes to web-accessible directories, leading to remote code execution.
KEVIntel captured in-the-wild exploitation within under two hours of Adobe publishing public details; the Canadian Center for Cyber Security (CCCS) confirmed the offensive activity.
BeyondTrust CVE-2026-40138 and CVE-2026-40139, both CVSS 9.2, are pre-authentication flaws in Remote Support and Privileged Remote Access systems that allow access control bypass.
KVM CVE-2026-53359 'Januscape' is a use-after-free in the shadow MMU code that went undetected for roughly 16 years, with a public PoC causing host panic; the researcher claims a separate, unreleased exploit for full code execution.

The Speed of Attack: ColdFusion Exploited in Under Two Hours

The timeline of CVE-2026-48282 measures the maturity of the attack ecosystem against legacy enterprise platforms. Ryan Dewhurst, founder of KEVIntel, stated: "Within under two hours of CVE-2026-48282 public details being released, KEVIntel captured in-the-wild exploitation within our global honeypot network" [SOURCE 2]. The quote documents a time interval that rules out human reactivity: operators already had ready exploits or the ability to reverse-engineer immediately based on patch details alone.

The CCCS issued an explicit advisory: "Open-source reporting indicates that CVE-2026-48282 is being exploited. The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates" [SOURCE 2]. Adobe's patch release — July 7, 2026 — carries a critical update classification for vulnerabilities "being targeted, or which have a higher risk of being targeted, by exploit(s) in the wild" [SOURCE 2]. Shadowserver detects approximately 800 ColdFusion instances exposed online [SOURCE 2].

BeyondTrust: Auth Bypass at 9.2 on Remote Access Infrastructure

Alongside the ColdFusion case, BeyondTrust fixed CVE-2026-40138 and CVE-2026-40139, both rated CVSS 9.2. The first affects Remote Support and Privileged Remote Access: "improper validation of authentication data could allow a network-positioned attacker to bypass access controls" [SOURCE 1]. The second, specific to Remote Support, stems from "improper processing of authentication requests" that allows an unauthenticated remote attacker to bypass access controls [SOURCE 1].

Both vulnerabilities are pre-authentication: they do not require valid credentials to trigger. BeyondTrust products manage remote support sessions and privileged access on enterprise infrastructure; the authentication bypass directly exposes the administrative access surface. The dossier does not document in-the-wild exploitation for these two CVEs. BeyondTrust has released updates for both [SOURCE 1].

KVM Januscape: 16 Years in the Shadow MMU, From Guest to Host

The third component of the bulletin is CVE-2026-53359, dubbed 'Januscape', a use-after-free in the Linux KVM hypervisor's shadow MMU code. The vulnerability remained undetected for roughly 16 years [SOURCE 1]. The technical mechanism corrupts host memory page state, enabling escape from guest VM to host on x86 Intel and AMD architectures [SOURCE 1].

The discovery came via Google's kvmCTF program, which offers rewards up to $250,000 for full guest-to-host escape [SOURCE 1]. Researcher Hyunwoo Kim published a PoC that causes host panic (DoS), but claims a separate, unreleased exploit for full code execution [SOURCE 1]. Patches have been distributed via Linux kernel stable updates [SOURCE 1]. The dossier does not report a specific CVSS score for this CVE.

Why This Matters

The ColdFusion CVE-2026-48282 case represents a quantitative benchmark on the temporal compression between disclosure and active exploitation: under two hours. This interval makes any reactive approach based on manual security bulletin analysis impractical. The series of late-June CVSS 10.0 vulnerabilities, of which this is part, shows a concentration of maximum-impact flaws on established enterprise platforms.

The source does not specify the actual volume of compromised systems beyond the approximately 800 exposed instances detected by Shadowserver. No infrastructure overlaps emerge linking the operators of this campaign to known threat actors. For BeyondTrust, the dossier does not document in-the-wild exploitation. For KVM Januscape, public availability of a full exploit remains unconfirmed: only the DoS PoC is verified.

"Within under two hours of CVE-2026-48282 public details being released, KEVIntel captured in-the-wild exploitation within our global honeypot network" — Ryan Dewhurst, founder KEVIntel

What to Do Now

Apply the Adobe patch for ColdFusion 2025.9, 2023.20, and earlier versions within the 72-hour perimeter indicated by the advisory.
Update BeyondTrust Remote Support and Privileged Remote Access products to the versions fixed in their respective advisories.
Apply Linux kernel stable updates for KVM on x86 Intel/AMD systems with active virtualization.

FAQ

Why was ColdFusion exploitation so fast?: The sub-two-hour timeline suggests operators possessed pre-developed exploits or automated reverse-engineering capabilities on patch details. The identity of the actors is not specified in the dossier.
Has BeyondTrust been actively attacked?: The dossier does not document in-the-wild exploitation for CVE-2026-40138 and CVE-2026-40139. Patches are available and the recommendation is preventive.
Does Januscape really allow VM escape?: Yes: the use-after-free mechanism in the shadow MMU corrupts host page state. The public PoC causes DoS (panic); the researcher claims a separate, unreleased RCE exploit.

The convergence of three critical vulnerabilities — ColdFusion, BeyondTrust, KVM — in a single late-June 2026 bulletin does not necessarily indicate coordination among actors, but measures the density of high-severity flaws across different layers of the enterprise stack: application, privileged access, kernel virtualization. The two-hour metric for ColdFusion will serve as the benchmark for assessing security teams' operational readiness in upcoming patch cycles.

Information is based on cited sources and current as of publication.

Sources

Sources and references