Adobe fixed multiple maximum-severity flaws in ColdFusion and Campaign Classic
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-48282 | Path Traversal Leading to RCE in Adobe ColdFusion CVE-2026-48282 is a path traversal vulnerability (CWE-22) in Adobe ColdFusion. It is triggered by crafted file-path input containing directory-traversal sequences that the application fails to constrain, allowing access outside the intended directory; per CISA this can escalate to arbitrary code execution in the context of the current user. Successful exploitation could give an attacker the ability to run code on the ColdFusion host under the ColdFusion service account, a common foothold for further network compromise. All organizations running affected Adobe ColdFusion releases, particularly internet-facing instances, are in scope; the specific affected version ranges have not been detailed in the available data. The flaw is already being exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-07 and carries a 42.4% EPSS probability of exploitation within 30 days (99th percentile), though no public PoC is known and ransomware use is unconfirmed. Do: Inventory all Adobe ColdFusion deployments, prioritizing internet-facing servers, and apply the vendor patch per Adobe's security advisory since the affected version ranges are not yet specified in this data. Federal agencies must patch or apply mitigations in accordance with CISA BOD 26-04 within the KEV deadline or discontinue use if mitigations are unavailable. Until patched, restrict external access to ColdFusion instances and consider WAF/IPS rules blocking directory-traversal sequences in file-path parameters. | 10.0 group max | 42% | KEV |
| largeon the order of tens of thousands of ColdFusion installations, with roughly 10,000-100,000 internet-exposed servers | |
| CVE-2026-48286 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. NVD description · AI analysis pending | 10.0 | 1% |
| — | ||
| CVE-2026-48316 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. NVD description · AI analysis pending | 10.0 | 1% |
| — |
Full article325 words · extracted from securityaffairs.com · click to collapse
Adobe fixed multiple critical flaws, including max severity bugs in ColdFusion and Campaign Classic that could lead to remote code execution
Adobe has released security updates for ColdFusion and Campaign Classic, fixing multiple critical vulnerabilities, including seven maximum-severity issues (CVSS score of 10.0). If exploited, the flaws could allow attackers to execute arbitrary code, escalate privileges, read sensitive files, or bypass security protections.
Adobe strongly recommends that customers apply the updates as soon as possible to reduce the risk of compromise.
The vulnerabilities include:
- CVE-2026-48276, CVE-2026-48283 (CVSS score of 10.0) – Allow attackers to upload malicious files and execute arbitrary code.
- CVE-2026-48277, CVE-2026-48281, CVE-2026-48316 (CVSS score of 10.0) – Input validation flaws that could let attackers execute arbitrary code.
- CVE-2026-48282 (CVSS score of 10.0) – A path traversal flaw that could result in arbitrary code execution.
- CVE-2026-48313 (CVSS score of 9.3) – A path traversal flaw that could let attackers read sensitive files.
- CVE-2026-48315 (CVSS score of 9.3) – An input validation flaw that could allow privilege escalation.
Adobe addressed these vulnerabilities in ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10. Security researchers Anirudh Anand, Matan Sandori, and 2Bsecure reported several of the vulnerabilities.
The firm thanked researchers for reporting the issues and helping improve security: Anirudh Anand reported CVE-2026-48283 and CVE-2026-48313, while Matan Sandori and 2Bsecure reported CVE-2026-48307.
The company also fixed a critical flaw, tracked as CVE-2026-48286 (CVSS score of 10.0) in Adobe Campaign Classic that could let attackers execute arbitrary code due to an authorization weakness.
The issue affects on-premises deployments running version 7.4.3 build 9396 and earlier and is fixed in build 9397. Adobe-hosted instances are not affected.
The software giant said it has seen no evidence of active exploitation.
“Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.” reads the advisory.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Coldfusion)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/194622/security/adobe-fixed-multiple-maximum-severity-flaws-in-coldfusion-and-campaign-classic.html