Adobe released Priority 1 updates for ColdFusion and Campaign Classic, led by a critical operating-system command injection flaw in ColdFusion scored 10.0 that could give an attacker arbitrary code execution. Tracked as CVE-2026-48362, it is accompanied by an eval-injection flaw scored 9.9 and an authorization flaw that can cause a denial of service. ColdFusion application servers are a long-standing target for attackers because they are widely internet-exposed and often run with broad access. Adobe is not aware of exploitation yet but urges installation within 72 hours given the priority rating. The Campaign Classic updates apply only to on-premises and hybrid on-premises deployments.
Adobe patched a critical flaw in Campaign Classic, its enterprise marketing automation platform, that can let an attacker run code without any user interaction. Tracked as CVE-2026-48449 and scored 10.0, it is an incorrect authorization issue leading to arbitrary code execution in the context of the current user. The same update fixes a high-severity SQL injection flaw that allows arbitrary file reads. Affected versions are Campaign Classic v7 build 9397 and earlier on Windows and Linux, mostly on-premises and hybrid deployments, with a fix in build 9398. Adobe says it is not aware of exploitation, and separately patched eight critical flaws in Adobe Bridge.
Adobe has released patches for seven critical, top-rated code execution vulnerabilities in its ColdFusion web application platform and Campaign Classic marketing tool. Six of the flaws affect ColdFusion 2025 and 2023 and stem from unrestricted file uploads, improper input validation, and path traversal, each allowing arbitrary code execution; the seventh, in Campaign Classic, is an authorization flaw with the same impact on on-premises installations. All can be exploited in low-complexity attacks without user interaction. Adobe says it is not aware of any active exploitation but assigned its highest deployment priority, urging admins to patch quickly, since ColdFusion has repeatedly been targeted by attackers and ransomware crews.
TrustStrike Labs