Adobe has released security updates addressing seven vulnerabilities across ColdFusion, Commerce, and Campaign Classic, including three critical vulnerabilities rated CVSS 10.0.
The most serious issues affect ColdFusion and Adobe Campaign Classic, with successful exploitation potentially resulting in arbitrary code execution. Adobe has classified the ColdFusion and Campaign Classic updates as Priority 1, indicating a higher likelihood that attackers could target affected systems.
The vulnerabilities are particularly significant for organizations running internet-facing ColdFusion infrastructure, enterprise application servers, and on-premises or hybrid Campaign Classic deployments.
There is currently no reported evidence that these newly disclosed vulnerabilities are being exploited in the wild. However, the combination of maximum-severity ratings, code-execution impact, and the enterprise-facing nature of the affected products makes this a patching priority.
Adobe recommends deploying the applicable fixes as soon as possible, with the reported guidance targeting remediation within 72 hours.
The Vulnerability Breakdown
CVE-2026-48362 — CVSS 10.0
ColdFusion OS Command Injection
CVE-2026-48362 is the most serious vulnerability in the ColdFusion portion of the update.
It carries a CVSS score of 10.0 and is classified as an operating-system command injection vulnerability.
Successful exploitation can lead to arbitrary code execution.
This is particularly concerning for ColdFusion servers exposed to untrusted networks because command injection crosses an important security boundary: application-layer input can potentially become operating-system-level execution.
The affected releases are addressed in:
- ColdFusion 2025.0.12
- ColdFusion 2023.0.23
From a defensive perspective, this is the vulnerability that should receive immediate attention in ColdFusion environments.
CVE-2026-48273 — CVSS 9.9
ColdFusion Eval Injection
CVE-2026-48273 carries a CVSS score of 9.9 and involves an eval injection vulnerability in ColdFusion.
Successful exploitation can result in arbitrary code execution.
The vulnerability is fixed in:
- ColdFusion 2025.0.12
- ColdFusion 2023.0.23
The combination of a near-maximum CVSS score and code-execution impact means this should not be treated as an ordinary application patch.
Organizations should identify whether ColdFusion instances are:
- Internet-facing
- Accessible through reverse proxies or load balancers
- Hosting business-critical applications
- Running privileged service accounts
- Connected to internal databases or enterprise identity infrastructure
CVE-2026-71384 — CVSS 9.6
ColdFusion Authorization Failure
CVE-2026-71384 is an incorrect authorization vulnerability with a CVSS score of 9.6.
Unlike the preceding two ColdFusion vulnerabilities, its stated impact is application denial-of-service rather than arbitrary code execution.
The fix is included in:
- ColdFusion 2025.0.12
- ColdFusion 2023.0.23
Although DoS may appear less severe than RCE, availability vulnerabilities in business-critical application platforms can still become operationally significant.
For organizations using ColdFusion as a front-end to critical business workflows, application availability should be considered part of the vulnerability’s business impact.
CVE-2026-71362 — CVSS 9.1
Adobe Commerce Privilege Escalation
CVE-2026-71362 affects Adobe Commerce and has a CVSS score of 9.1.
The vulnerability is classified as an incorrect authorization issue that can lead to privilege escalation.
Privilege escalation is particularly important in commerce platforms because administrative privileges can provide access to:
- Customer information
- Orders
- Product catalogs
- Payment-related workflows
- Administrative functionality
- Configuration
- Application integrations
The appropriate remediation is to apply Adobe’s applicable Commerce security update rather than relying solely on compensating controls.
CVE-2026-71398 — CVSS 10.0
Campaign Classic Authorization Vulnerability
CVE-2026-71398 carries the maximum CVSS score of 10.0.
The vulnerability is described as an incorrect authorization vulnerability that can result in arbitrary code execution.
Adobe lists the fix as:
Adobe Campaign Classic v7 7.4.4 build 9400
This vulnerability is particularly relevant to organizations operating Campaign Classic within their own infrastructure.
CVE-2026-27302 — CVSS 10.0
Another Maximum-Severity Campaign Classic RCE
CVE-2026-27302 is another CVSS 10.0 vulnerability affecting Campaign Classic.
It is also classified as an incorrect authorization vulnerability with potential for arbitrary code execution.
The remediation is:
Campaign Classic v7 7.4.4 build 9400
Having two separate CVSS 10.0 vulnerabilities in the same product release substantially increases the urgency for organizations operating affected Campaign Classic deployments.
CVE-2026-48381 — CVSS 9.0
Campaign Classic SQL Injection
The seventh vulnerability is CVE-2026-48381, a SQL injection vulnerability with a CVSS score of 9.0.
Adobe reports that successful exploitation could ultimately result in arbitrary code execution.
The fix is included in:
Campaign Classic v7 7.4.4 build 9400
SQL injection remains especially dangerous in applications that have broad database privileges or expose database-backed functionality through externally reachable interfaces.
Why the ColdFusion Issues Matter
ColdFusion has historically been an attractive target because it often sits at the intersection of:
Internet → Web/Application Server → Database → Enterprise Network
A compromise at the application-server layer can therefore become much more significant than the initial CVSS description suggests.
The current release contains two particularly important code-execution vulnerabilities:
CVE-2026-48362 → OS command injection → RCE
CVE-2026-48273 → Eval injection → RCE
An attacker who can successfully exploit a vulnerable ColdFusion deployment may potentially transition from application-layer access to operating-system-level execution.
That is why these vulnerabilities should be treated as attack-surface vulnerabilities, not merely application defects.
The Campaign Classic Angle
The Campaign Classic fixes deserve separate attention.
Adobe states that the Campaign Classic updates apply to fully on-premises deployments and the on-premises components of hybrid deployments.
Adobe-hosted instances have already been remediated and do not require customer action for these vulnerabilities.
This creates an important distinction for vulnerability-management teams:
SaaS/Adobe-hosted → Adobe manages remediation
On-premises → Customer must validate and patch
Hybrid → Customer must identify the affected on-premises components
Asset inventory therefore becomes critical.
An organization may know that it uses Adobe Campaign but still miss an affected on-premises component because the application is managed by a separate application or marketing-technology team.
Priority 1 Changes the Patch Conversation
Adobe has assigned Priority 1 to the ColdFusion and Campaign Classic updates.
This matters because CVSS alone should not determine remediation priority.
A mature vulnerability-management program should combine:
CVSS + exploitability + exposure + asset criticality + business impact + threat intelligence
For example:
A CVSS 9.0 vulnerability on an isolated development server is not necessarily more urgent than a CVSS 8.0 vulnerability on an internet-facing production application.
In this case, however, the combination of CVSS 10.0/9.9 vulnerabilities, RCE impact, enterprise application platforms, and Priority 1 classification creates a strong case for accelerated remediation.
What Security Teams Should Do Now
1. Identify every affected deployment
Search CMDB, EASM, vulnerability scanners, cloud inventories and application inventories for:
- ColdFusion 2025
- ColdFusion 2023
- Adobe Commerce
- Adobe Campaign Classic
- On-premises Campaign Classic components
- Hybrid Campaign Classic infrastructure
Do not depend on a single inventory source.
2. Verify the exact installed version
Version-level validation is critical.
For ColdFusion, confirm whether systems are running versions older than the fixed releases:
- 2025.0.12
- 2023.0.23
For Campaign Classic:
- v7 7.4.4 build 9400
3. Prioritize internet-facing assets
Immediately identify systems reachable from:
- Internet
- DMZ
- Partner networks
- Remote-access infrastructure
- Public APIs
- External reverse proxies
Internet exposure should increase the remediation priority.
4. Patch production systems
Apply the appropriate Adobe security updates after validating application compatibility and change-management requirements.
For critical externally exposed ColdFusion systems, the 72-hour remediation objective should be taken seriously.
5. Hunt for signs of compromise
Although Adobe reports no evidence of exploitation in the wild at disclosure, organizations should not interpret that as a guarantee of safety.
For exposed ColdFusion and Campaign Classic systems, review:
- Web-server access logs
- Application logs
- Authentication events
- Unexpected administrative activity
- New or modified application files
- Suspicious child processes
- Outbound connections from application servers
- Unexpected PowerShell, shell or scripting activity
- Database anomalies
- Creation of new privileged accounts
6. Validate service-account privileges
An application compromise becomes considerably more dangerous when the application service account has excessive privileges.
Review:
ColdFusion → Service Account → OS → Database → Network
Minimize privileges wherever practical.
7. Add the CVEs to vulnerability-management tracking
At minimum, create individual tracking records for:
- CVE-2026-48362
- CVE-2026-48273
- CVE-2026-71384
- CVE-2026-71362
- CVE-2026-71398
- CVE-2026-27302
- CVE-2026-48381
Track:
Exposure → Ownership → Business Criticality → Patch Status → Validation → Residual Risk
Detection and Validation Strategy
Patching should not be the end of the process.
For internet-facing ColdFusion systems, security teams should perform a post-patch validation cycle:
Discover → Patch → Verify → Scan → Hunt → Close
The verification stage should confirm that:
- The vulnerable version is no longer present.
- The expected Adobe security update is installed.
- External exposure remains intentional.
- No unexpected administrative changes occurred.
- No suspicious processes were spawned.
- No anomalous outbound traffic originated from the application server.
If exploitation is suspected, patching alone should not close the incident.
The organization should move into incident-response and compromise-assessment procedures.
The Vulnerability-Management Lesson
The bigger lesson from this Adobe release is not simply:
“Patch seven Adobe vulnerabilities.”
The real lesson is:
Critical application vulnerabilities must be connected to asset exposure and business context.
A vulnerability-management dashboard showing:
CVE-2026-48362 | CVSS 10.0 | Critical
is useful.
A risk record showing:
CVE-2026-48362 → Internet-facing ColdFusion → Production → Customer-facing application → Privileged service account → RCE → Critical business service
is far more useful.
That is the difference between vulnerability counting and vulnerability risk management.
Executive Takeaway
Adobe’s August 2026 security release contains three CVSS 10.0 vulnerabilities, alongside four additional high-severity vulnerabilities.
The highest-risk issues are:
CVE-2026-48362 — ColdFusion — CVSS 10.0 — OS command injection — RCE
CVE-2026-71398 — Campaign Classic — CVSS 10.0 — Incorrect authorization — RCE
CVE-2026-27302 — Campaign Classic — CVSS 10.0 — Incorrect authorization — RCE
ColdFusion administrators should additionally prioritize CVE-2026-48273, a CVSS 9.9 eval-injection vulnerability capable of arbitrary code execution.
There is no reported evidence of active exploitation at the time of disclosure, but the risk profile warrants accelerated remediation.
For security leaders, the immediate question should not be:
“How many Adobe vulnerabilities do we have?”
It should be:
“Where are these vulnerable Adobe platforms exposed, what business processes depend on them, and how quickly can we eliminate the attack path?”
That is the real patch-management decision.
Final Word
CVSS tells you how bad the vulnerability can be.
Exposure tells you how reachable it is.
Asset criticality tells you what is at stake.
Threat intelligence tells you how urgently the threat is evolving.
For these Adobe vulnerabilities, all four dimensions should feed the remediation decision.
Patch the exposed systems first. Validate the fix. Hunt for evidence. Then close the risk.
