CVE-2026-48282 — Adobe ColdFusion RDS Validation and Detection

Laboratory validation of CVE-2026-48282 in Adobe ColdFusion Remote Development Services (RDS), focused on technical evidence, event reconstruction, and defensive detection opportunities.

The repository documents a controlled test in which the vulnerable RDS FILEIO functionality was used to write a CFM file to a ColdFusion application directory. Invoking the file over HTTP caused ColdFusion to start a system shell and establish an outbound connection. The resulting process and network activity was captured using Linux auditd, tcpdump, Docker telemetry, ColdFusion logs, and Windows Event ID 4688.

[!IMPORTANT] This repository contains reports and screenshots only. The custom file-upload/payload implementation is intentionally not included, because publishing directly reusable exploitation code would add unnecessary offensive capability. The material is intended for vulnerability validation, SOC engineering, detection development, and authorized research.

Reports

• English validation report
• Polish validation report

Both reports contain the full test methodology, evidence excerpts, timeline, process chain, network indicators, mitigation guidance, audit recommendations, and example SIEM logic.

Repository structure

.
├── README.md
├── SHA256SUMS.txt
├── reports/
│   ├── CVE-2026-48282_ColdFusion_RDS_detection_EN.pdf
│   └── CVE-2026-48282_ColdFusion_RDS_detection_PL.pdf
└── screenshots/
    ├── 01_rds_authentication_no_authentication.png
    ├── 02_vulnerability_check.png
    ├── 03_rds_file_write_validation.png
    ├── 04_reverse_shell_session.png
    └── 05_connect_cfm_on_ubuntu_host.png

No exploit source, payload source, CFM payload, raw PCAP, or raw host evidence package is included.

Test environment

Role	System
Victim host	Ubuntu 24.04.4 LTS, kernel 6.17.0-35-generic, Docker Engine 29.5.3
Target application	Adobe ColdFusion 2025 Update 9, image adobecoldfusion/coldfusion2025:2025.0.9
Container	coldfusion-2025-u9
Attacker workstation	Microsoft Windows 11 Home 10.0.26200
ColdFusion service	http://172.20.10.3:8500
Windows test address	172.20.10.2
Container address	172.19.0.2
Test date	7 July 2026

The ColdFusion application directory /app was mapped from the Ubuntu host path /home/user/coldfusion-u9/app as a Docker bind mount.

What was validated

The test was performed in an isolated and authorized laboratory environment. The validation covered the following sequence:

1. Adobe ColdFusion 2025 Update 9 was deployed in Docker.
2. RDS was enabled for the laboratory test, with the authentication mode set to No authentication needed.
3. The public project listed in References was used to confirm that the RDS endpoint was reachable and that the tested instance appeared vulnerable.
4. A laboratory-only uploader was used to submit a CFM file through the RDS FILEIO operation to /app/connect.cfm.
5. The file was invoked through GET /connect.cfm.
6. ColdFusion launched /bin/bash through the Java process execution path.
7. The shell established an outbound TCP connection to the Windows workstation.
8. Non-destructive discovery commands were executed to confirm the effective user, operating system, and working directory.
9. Evidence from the attacker and victim systems was correlated into a single UTC timeline.

The reports intentionally document the evidence and detection logic without distributing the custom uploader or payload implementation.

Confirmed result

The laboratory test confirmed:

• arbitrary CFM file write through the RDS FILEIO endpoint in the tested configuration;
• execution of the written CFM file by ColdFusion after an HTTP request;
• creation of the process chain:

ColdFusion Java
└── jspawnhelper
    └── /bin/bash -c ...
        └── bash -i
            ├── whoami
            ├── uname
            └── id

• an outbound shell connection from the ColdFusion container to the Windows host;
• execution in the context of the ColdFusion service user, not as root.

Inside the container, the effective identity was:

uid=999(cfuser) gid=999(cfuser) groups=999(cfuser)

On the Ubuntu host, UID 999 was resolved using the host account database as dnsmasq, which explains the different username shown in host-level auditd records and file ownership output.

Key evidence

RDS configuration

The administrative configuration used for the test is shown below. The No authentication needed option was enabled only for the controlled laboratory validation.

Initial vulnerability check

The initial check confirmed that the RDS endpoint was reachable and reported arbitrary file read/write behavior through path traversal.

CFM file write

The laboratory uploader submitted the local CFM test artifact to /app/connect.cfm. The server returned the RDS response 1:2:XX, and the written resource was subsequently reachable over HTTP.

Code execution and service-account context

The resulting shell session confirmed execution as the ColdFusion service account. The commands shown in the screenshot were limited to environment identification.

File on the Ubuntu bind mount

The file appeared in /home/user/coldfusion-u9/app, the host path mounted into the container as /app.

Reconstructed timeline

The complete timeline is available in both PDF reports. The most important events were:

UTC	Event
20:55:17	Administrator login to CFADMIN
20:55:32	RDS security enabled and authentication set to No authentication needed
21:13:22	Linux auditing, packet capture, and Docker collectors started
21:14:25	Vulnerability-check script executed from Windows
21:14:40.940	POST /CFIDE/main/ide.cfm?ACTION=FILEIO with a WRITE operation to /app/connect.cfm
21:14:40.944	RDS returned 1:2:XX
21:14:40.950	Browser requested /connect.cfm
21:14:41.321	ColdFusion Java launched jspawnhelper
21:14:41.324	ColdFusion launched /bin/bash
21:14:56	ncat.exe -lv 4444 started on Windows
21:15:00.726	Outbound connection to 172.20.10.2:4444 succeeded
21:15:07–21:15:15	whoami, uname, id, and pwd confirmed the execution context
21:15:20	Session closed

Evidence collection methodology

Linux and Docker

The victim host collected:

• auditd events for execve, execveat, and connect where the effective UID was 999;
• watches on the ColdFusion webroot and log directory;
• tcpdump traffic for the HTTP and callback ports;
• periodic process and socket snapshots;
• Docker container metadata, logs, events, process listings, and filesystem differences;
• ColdFusion application and administrative logs;
• SHA-256 hashes and metadata baselines.