CVE-2026-48362: Adobe ColdFusion Command Injection (CVSS 10.0) — Detection and Remediation Guide

---
title: ColdFusion Service Spawning OS Shell (Possible CVE-2026-48362 Exploitation)
id: 3f8c2a71-6b4d-4e91-a2c7-9d1e5f0a8b33
status: experimental
description: Detects the ColdFusion server process spawning cmd.exe, powershell.exe, or other shells — a high-fidelity indicator of OS command injection exploitation such as CVE-2026-48362.
references:
  - https://thehackernews.com/2026/08/adobe-patches-three-cvss-100-coldfusion.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\cfusion.exe'
      - '\jrunsvc.exe'
      - '\jrun.exe'
      - '\coldfusion.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legacy CFML applications using cfexecute for legitimate OS commands
level: high
---
title: Webshell Dropped into ColdFusion Webroot
id: 9a1d4e62-7c3f-4b58-b6d2-4e8f1a0c5d77
status: experimental
description: Detects creation of script files (CFM, JSP, ASPX) in ColdFusion webroot or CFIDE directories — consistent with post-exploitation webshell deployment following ColdFusion RCE.
references:
  - https://thehackernews.com/2026/08/adobe-patches-three-cvss-100-coldfusion.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\cfusion\wwwroot\'
      - '\ColdFusion\'
      - '\CFIDE\'
  selection_ext:
    TargetFilename|endswith:
      - '.cfm'
      - '.cfc'
      - '.jsp'
      - '.aspx'
      - '.php'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate developer deployments of CFML templates (correlate with change windows)
level: medium
---
title: Linux ColdFusion Process Spawning Shell (Command Injection Indicator)
id: 5e7b9f03-2d8a-4c61-9a3b-8f2c6d4e1a90
status: experimental
description: Detects ColdFusion-related Java processes on Linux spawning interactive or scripting shells — a strong indicator of OS command injection exploitation (e.g., CVE-2026-48362).
references:
  - https://thehackernews.com/2026/08/adobe-patches-three-cvss-100-coldfusion.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'cfusion'
      - 'coldfusion'
      - 'jrun'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Administrative maintenance scripts invoked through ColdFusion scheduled tasks
level: high

// Hunt: ColdFusion service spawning shells or recon tooling — possible CVE-2026-48362 exploitation
let cfParents = dynamic(["cfusion.exe", "jrunsvc.exe", "jrun.exe", "coldfusion.exe"]);
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "net.exe", "nltest.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe"]);
let windowsEvents = DeviceProcessEvents
| where InitiatingProcessFileName in~ (cfParents)
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReportId
| extend Source = "Defender";
let linuxEvents = Syslog
| where SyslogMessage has_any ("cfusion", "coldfusion", "jrun")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "python", "nc ", "base64")
| project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage
| extend Source = "Syslog";
union isfuzzy=true windowsEvents, linuxEvents
| order by TimeGenerated desc

-- Artifact: ColdFusion Command Injection Triage (CVE-2026-48362)
-- 1. Suspicious child processes of ColdFusion service
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(cmd\.exe|powershell|pwsh|whoami|certutil|bitsadmin|/bin/(ba)?sh|curl|wget|nc )'
  AND (
    Exe =~ '(?i)(cmd|powershell|pwsh|sh|bash|curl|wget|nc)'
  )

-- 2. Recently created/modified script files in ColdFusion webroots (last 14 days)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/ColdFusion*/cfusion/wwwroot/**/*.cfm',
  'C:/ColdFusion*/cfusion/wwwroot/**/*.cfc',
  'C:/ColdFusion*/cfusion/wwwroot/**/*.jsp',
  'C:/ColdFusion*/cfusion/wwwroot/CFIDE/**/*',
  '/opt/coldfusion*/cfusion/wwwroot/**/*.cfm',
  '/opt/coldfusion*/cfusion/wwwroot/**/*.jsp'
])
WHERE Mtime > (now() - 1209600)
ORDER BY Mtime DESC

# ColdFusion CVE-2026-48362 triage & verification script
# Run elevated on each ColdFusion host. Review output before patching.

# 1. Identify running ColdFusion services and their versions
Write-Host "=== ColdFusion Services ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match 'ColdFusion|cfusion|jrun' -or $_.PathName -match 'ColdFusion'
} | Select-Object Name, State, StartName, PathName | Format-List

# 2. Check for suspicious child processes of the ColdFusion service (live exploitation indicator)
Write-Host "=== Suspicious Child Processes of ColdFusion ===" -ForegroundColor Cyan
$cfProcs = Get-CimInstance Win32_Process | Where-Object { $_.Name -match 'cfusion|jrun' }
foreach ($p in $cfProcs) {
    Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq $p.ProcessId } |
    Where-Object { $_.Name -match 'cmd|powershell|pwsh|certutil|bitsadmin|whoami|net\.exe|wscript|cscript|mshta' } |
    Select-Object ProcessId, Name, CommandLine, CreationDate | Format-List
}

# 3. Flag recently modified scripts in the webroot (last 14 days) - possible webshells
Write-Host "=== Recently Modified Webroot Scripts ===" -ForegroundColor Cyan
Get-ChildItem -Path 'C:\ColdFusion*\cfusion\wwwroot' -Recurse -Include *.cfm,*.cfc,*.jsp,*.aspx,*.php -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Sort-Object LastWriteTime -Descending |
    Select-Object FullName, LastWriteTime | Format-Table -AutoSize

# 4. Confirm current hotfix level - compare against Adobe advisory APSB26-xx patched builds
Write-Host "=== ColdFusion Version ===" -ForegroundColor Cyan
Get-ChildItem 'C:\ColdFusion*\cfusion\lib\cfusion.jar' -ErrorAction SilentlyContinue |
    Select-Object FullName, @{N='Version';E={$_.VersionInfo.ProductVersion}}, LastWriteTime | Format-List
Write-Host "ACTION: Verify version against https://helpx.adobe.com/security/products/coldfusion.html and apply the latest hotfix via the ColdFusion Administrator or command-line installer." -ForegroundColor Yellow

#!/bin/bash
# ColdFusion Linux triage - run as root on each ColdFusion host

echo "=== ColdFusion processes and version ==="
ps aux | grep -iE 'cfusion|coldfusion|jrun' | grep -v grep
cat /opt/coldfusion*/cfusion/lib/updates/chf*.txt 2>/dev/null | head -20

echo "=== Suspicious child processes of ColdFusion ==="
CF_PID=$(pgrep -f cfusion | head -1)
[ -n "$CF_PID" ] && ps --ppid "$CF_PID" -o pid,comm,args

echo "=== Webroot scripts modified in last 14 days ==="
find /opt/coldfusion*/cfusion/wwwroot -type f \( -name '*.cfm' -o -name '*.cfc' -o -name '*.jsp' \) -mtime -14 -ls 2>/dev/null

echo "=== Outbound connections from ColdFusion process (C2 check) ==="
[ -n "$CF_PID" ] && ss -tnp | grep "$CF_PID"