A critical vulnerability in Adobe ColdFusion, identified as CVE-2026-48282, is currently being exploited by attackers. This maximum-severity flaw allows for unauthenticated remote code execution on vulnerable servers. Exploitation began just days after Adobe released security updates on July 1, 2026. The vulnerability requires no credentials or user interaction, making it extremely dangerous. Attackers can use this to gain unauthorized access, steal data, and move laterally within a network. Organizations running internet-facing ColdFusion 2025, 2023, or earlier versions are at significant risk. Adobe strongly recommends applying the July 1, 2026 updates within 72 hours. There are approximately 800 ColdFusion instances currently visible online, representing a potential attack surface. Beyond patching, organizations should also hunt for signs of compromise on exposed systems. This includes reviewing logs and searching for malicious files or connections. Given the rapid exploitation, assuming breach is advised for previously exposed hosts.