ColdFusion and SimpleHelp: Two-Hour Exploitation Timelines

ColdFusion and SimpleHelp: Two-Hour Exploitation Timelines

•

Episode description

ColdFusion and SimpleHelp: Two-Hour Exploitation Timelines

Two critical vulnerabilities are under active exploitation right now, with direct implications for UK small businesses. Adobe ColdFusion CVE-2026-48282 carries a perfect CVSS 10.0 score and was weaponised within two hours of public disclosure. The vulnerability allows unauthenticated remote code execution on affected servers. Meanwhile, SimpleHelp RMM CVE-2026-48558 enables attackers to create Technician accounts on unpatched servers, granting access to every client system managed through that infrastructure. Hundreds of vulnerable SimpleHelp servers remain exposed worldwide weeks after patches became available. Both vulnerabilities highlight a structural problem: attackers now operate at machine speed whilst defenders, particularly in under-resourced environments, operate at human speed. Monthly patch cycles are structurally inadequate when exploitation timelines are measured in hours. This episode provides three specific, answerable questions to ask your IT provider before the end of the week, with guidance on why written responses matter for cyber insurance and due diligence. The NCSC’s vulnerability management and supply chain security guidance is referenced throughout. Your MSP’s patch status is your risk, not theirs.

Chapters

  • Introduction: The Two-Hour Weaponisation Window Corrine introduces two critical vulnerabilities currently under active exploitation. A CVSS 10.0 Adobe ColdFusion flaw was weaponised within two hours of disclosure, and a SimpleHelp RMM vulnerability affects MSP tooling. Both have direct consequences for UK small businesses, even for those unaware they use the affected software.
  • Adobe ColdFusion CVE-2026-48282: A Perfect Ten for the Wrong Reasons Analysis of CVE-2026-48282, a path traversal vulnerability allowing unauthenticated remote code execution on Adobe ColdFusion servers. Adobe issued patches on 30 June 2026. The Canadian Centre for Cyber Security confirmed active exploitation, with weaponisation occurring within two hours of disclosure. Monthly patch cycles are structurally inadequate for such rapid exploitation timelines.
  • Call to Action Listener engagement request: follow the show, leave ratings and reviews, and share with those responsible for IT contracts.
  • SimpleHelp RMM CVE-2026-48558: Your MSP’s Tooling as the Attack Vector Examination of CVE-2026-48558, which allows unauthenticated creation of Technician accounts on vulnerable SimpleHelp servers. The Shadowserver Foundation identified hundreds of unpatched servers worldwide. A compromised RMM server grants attackers simultaneous access to all client systems managed through that MSP’s infrastructure.
  • The Exploitation Timeline and What It Tells Us Both vulnerabilities demonstrate the structural asymmetry between machine-speed attacks and human-speed defence. The NCSC’s vulnerability management and supply chain security guidance addresses these risks explicitly. IT providers require documented emergency patch procedures for critical vulnerabilities with active exploitation, not monthly cycles.
  • Conclusion: Three Questions for Your IT Provider Three specific questions to ask your IT provider before week’s end: SimpleHelp patch status, ColdFusion patch status, and emergency patch procedures. Written answers create audit trails useful for cyber insurance renewals and client due diligence. Asking the question provides material advantage over those who do not.

Links