CVE Tools
Track your stack

Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic

The Hacker NewsBy The Hacker News

PatchColdFusionAdobe Campaign Classic

Our summary

Adobe has issued fixes for multiple highest-severity vulnerabilities affecting Adobe ColdFusion and Adobe Campaign Classic. In ColdFusion, multiple CVSS 10.0 issues (CVE-2026-48276, CVE-2026-48283, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282) plus additional high-severity flaws (CVE-2026-48313, CVE-2026-48315) could enable arbitrary code execution, privilege escalation, arbitrary file reads, and security bypasses, with patches available in ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10. Adobe Campaign Classic is also affected by CVE-2026-48286 (CVSS 10.0), where incorrect authorization can lead to arbitrary code execution; it is fixed in ACC v7: 7.4.3 build 9397 for affected on-premise Windows and Linux deployments.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. SecurityWeekAdobe Patches Critical ColdFusion, Campaign Classic VulnerabilitiesCVE-2026-48276, CVE-2026-48277 +8
  2. Хакер (xakep.ru)Критический баг в Adobe ColdFusion уже используется в атакахCVE-2026-48276, CVE-2026-48277 +7
  3. The Hacker News⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and MoreCVE-2026-48276, CVE-2026-48277 +7
  4. watchTowr LabsIt’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza)CVE-2026-48276, CVE-2026-48277 +7
  5. BleepingComputerAdobe patches seven max severity ColdFusion, Campaign flawsCVE-2026-48276, CVE-2026-48277 +4
  6. Help Net SecurityAttackers exploit critical Adobe ColdFusion vulnerability (CVE-2026-48282)CVE-2026-48276, CVE-2026-48282
  7. Help Net SecurityWeek in review: Accenture data breach, great open-source cybersecurity toolsCVE-2026-48282
  8. Help Net SecurityJuly 2026 Patch Tuesday forecast: Is CVE tracking still practical?CVE-2026-48282
  9. SecurityWeekCISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla FlawsCVE-2026-48282
  10. BleepingComputerCISA orders feds to patch max severity ColdFusion flaw by FridayCVE-2026-48282

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store