Adobe ColdFusion

Adobe ColdFusion is a commercial rapid-application-development platform and web application server, first launched in the mid-1990s and now owned by Adobe. It is used to build and run dynamic, database-driven web applications, and remains embedded in a substantial number of enterprise and government systems despite being decades old.

Unlike the Joomla extensions that dominated this fortnight's KEV additions, ColdFusion is core enterprise infrastructure: a compromise typically exposes an entire backend application rather than a single plugin's functionality.

A ColdFusion PATH-traversal vulnerability was added to CISA's Known Exploited Vulnerabilities catalogue on 7 July 2026, with a compliance Deadline of 10 July, just three days later. It stood out as the fortnight's only widely deployed enterprise product among a run of adds otherwise dominated by Joomla-ecosystem plugins.

PATH-traversal flaws let an attacker read or write files outside a web application's intended directory, and in an application server context can lead directly to Remote Code Execution, explaining the unusually tight federal remediation window.