Adobe patches ColdFusion command injection flaw scored a perfect ten

Adobe released Priority 1 updates for ColdFusion and Campaign Classic, led by a critical operating-system command injection flaw in ColdFusion scored 10.0 that could give an attacker arbitrary code execution. Tracked as CVE-2026-48362, it is accompanied by an eval-injection flaw scored 9.9 and an authorization flaw that can cause a denial of service. ColdFusion application servers are a long-standing target for attackers because they are widely internet-exposed and often run with broad access. Adobe is not aware of exploitation yet but urges installation within 72 hours given the priority rating. The Campaign Classic updates apply only to on-premises and hybrid on-premises deployments.

Check

Update ColdFusion to the fixed 2025 and 2023 releases within Adobe's 72-hour window, and confirm internet-facing ColdFusion servers are not running with unnecessary privileges or exposure.

Affected

Organizations running affected Adobe ColdFusion (CVE-2026-48362); an attacker could achieve arbitrary code execution through operating-system command injection, and ColdFusion servers are frequently exposed and targeted.

Fix

Apply the Priority 1 updates quickly, restrict and monitor ColdFusion server access, run it with least privilege, and watch for unexpected process execution, since command-injection flaws are attractive and often weaponized fast.