Adobe ColdFusion Zero-Day: CVSS 10.0, 2-Hour Exploit [2026]

Adobe published APSB26-68 on June 30, 2026, a routine-looking security bulletin patching a critical flaw in ColdFusion; the bulletin addresses multiple issues, including CVE-2026-48282. Ten days later, that same flaw sat on the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, and federal civilian agencies had a three-day window to patch it or pull affected systems offline. The story didn’t end there: by August 2026, Adobe had shipped APSB26-90, a follow-on bulletin fixing 15 CVEs with a top severity of CVSS 10.0, according to the Zero Day Initiative, underscoring how ColdFusion’s 2026 patch cycle has become an ongoing affair rather than a one-time fix.