VulnerabilitycriticalExploited in the wild

Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

The Hacker Newsby @TheHackersNewsAug 15, 2026 · 00:00 UTC (Aug 15, 2026)2 min read1 · 1 read

AI summary · glm-5.3-flashSummaries by Vani AI

Adobe patches seven flaws in ColdFusion, Commerce, and Campaign Classic, including actively exploited CVE-2026-71362 enabling customer account takeover.

Adobe issued Priority 1 updates fixing CVSS 10.0 flaws in ColdFusion (CVE-2026-48362, OS command injection) and Campaign Classic (CVE-2026-71398, CVE-2026-27302, incorrect authorization), plus CVE-2026-71362 (CVSS 9.1) in Adobe Commerce and Magento Open Source. Sansec reports threat actors are actively exploiting CVE-2026-71362 to switch customer sessions to other accounts and access private customer data. Adobe-hosted Campaign Classic instances are already remediated, while on-premise deployments are urged to patch within 72 hours. ColdFusion fixes ship in versions 2025.0.12 and 2023.0.23, and Campaign Classic fixes in v7 7.4.4 build 9400.

Key facts

CVE-2026-48362, CVE-2026-71398 and CVE-2026-27302 are rated CVSS 10.0 and marked Priority 1 by Adobe
Sansec observed attackers exploiting CVE-2026-71362 to hijack customer sessions in Commerce and Magento
ColdFusion fixes ship in 2025.0.12 and 2023.0.23; Campaign Classic fixes in 7.4.4 build 9400
Adobe-hosted Campaign Classic instances already remediated; on-premise deployments must act quickly

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-48362 CVE-2026-48273 CVE-2026-71384 CVE-2026-71362 CVE-2026-71398 CVE-2026-27302 CVE-2026-48381 CVE-2026-48449

Tags: adobe adobe-commerce campaign-classic coldfusion command-injection magento privilege-escalation sql-injection

Vendors: Adobe Sansec
Products: Adobe ColdFusion Adobe Commerce Magento Open Source Adobe Campaign Classic
Organizations: Adobe Sansec

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-71398 +2 related CVEs CVE-2026-27302 CVE-2026-48381	Unauthenticated RCE in Adobe Campaign Classic via Incorrect Authorization	10.0 group max	<1%		Aug 11, 2026
CVE-2026-48273	Eval Injection RCE in Adobe ColdFusion (CVSS 9.9, low-privileged attacker)	9.9	2%		Sep 8, 2026
CVE-2026-48362 +1 related CVE CVE-2026-71384	Unauthenticated OS Command Injection RCE in Adobe ColdFusion	10.0 group max	4%		Aug 11, 2026
CVE-2026-48449	Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the…	9.8	<1%		Jul 30, 2026
CVE-2026-71362	Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento)	9.1	90%	KEVPoC	Aug 11, 2026 KEV Sep 24, 2026

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Aug 12, 2026 Vulnerability / Web Security Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. CVE-2026-48362 (CVSS score: 10.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.