Adobe has released security updates that address seven critical vulnerabilities in ColdFusion, Adobe Commerce and Adobe Campaign Classic. Three of them received the maximum CVSS 10.0 score, allowing attackers to execute arbitrary code on vulnerable systems. The updates for ColdFusion and Campaign Classic have been given an Adobe Priority 1 rating, indicating an elevated risk of targeted attacks. Administrators are advised to install the patches within 72 hours.
ColdFusion vulnerabilities: OS command injection and eval injection
The most dangerous of the identified vulnerabilities — CVE-2026-48362 (CVSS 10.0) — is an OS command injection vulnerability in ColdFusion. Successful exploitation allows an attacker to execute arbitrary code on the server. A maximum CVSS score means that exploitation does not require authentication and can be carried out remotely, with full compromise of the system’s confidentiality, integrity and availability.
The second critical ColdFusion vulnerability — CVE-2026-48273 (CVSS 9.9) — is related to eval injection and also leads to arbitrary code execution. The third vulnerability — CVE-2026-71384 (CVSS 9.6) — is an authorization error that can result in a denial of service for the application.
All three ColdFusion vulnerabilities are fixed in versions 2025.0.12 and 2023.0.23.
Campaign Classic: three vulnerabilities with maximum and high CVSS
In Adobe Campaign Classic, two vulnerabilities with a CVSS score of 10.0 were discovered, both related to improper authorization:
- CVE-2026-71398 (CVSS 10.0) — an authorization error leading to arbitrary code execution
- CVE-2026-27302 (CVSS 10.0) — a similar authorization error with the same exploitation vector
- CVE-2026-48381 (CVSS 9.0) — an SQL injection issue that also allows arbitrary code execution
All three vulnerabilities are fixed in ACC v7 7.4.4 build 9400. A critically important nuance: the updates apply only to fully on-premises deployments and to on-premises components of hybrid installations. Campaign Classic instances hosted on Adobe infrastructure have already been patched and require no action from customers.
Adobe Commerce: privilege escalation
In Adobe Commerce, the vulnerability CVE-2026-71362 (CVSS 9.1) was discovered — an authorization error that allows an attacker to escalate privileges in the system. For an e-commerce platform, such a vulnerability is particularly dangerous: obtaining administrative access opens the way to manipulation of orders, customer data and payment information.
Impact assessment
The combination of several factors makes this set of vulnerabilities particularly dangerous. ColdFusion is widely used in corporate environments for web applications, and Campaign Classic is a key marketing automation tool for large organizations. The OS command injection (CVE-2026-48362) and eval injection (CVE-2026-48273) vulnerabilities in ColdFusion provide an attacker with a direct path to code execution on the server, which can lead to complete compromise of the infrastructure.
It is worth noting a worrying trend: reportedly, less than two weeks ago Adobe had already released a patch for another maximum-severity vulnerability in Campaign Classic — CVE-2026-48449 (CVSS 10.0), also related to arbitrary code execution. The reappearance of critical vulnerabilities in the same product within such a short period points to systemic security issues in the code base.
At the time of publication, no confirmed cases of exploitation of these vulnerabilities have been recorded, and none of them has been added to the CISA KEV catalog. However, assigning a Priority 1 rating to the ColdFusion and Campaign Classic updates means that Adobe assesses the likelihood of targeted attacks as high.
Mitigation recommendations
- ColdFusion: upgrade to version 2025.0.12 or 2023.0.23, depending on the branch in use
- Campaign Classic: install ACC v7 7.4.4 build 9400 on all on-premises and hybrid installations; no action is required for Adobe-hosted cloud instances
- Adobe Commerce: install the update that fixes CVE-2026-71362
- Installation priority — within 72 hours, in accordance with Adobe’s recommendations for Priority 1 updates
- After updating, check ColdFusion and Campaign Classic server logs for signs of unauthorized command execution or anomalous authorization requests
Organizations using ColdFusion, Adobe Commerce or Campaign Classic in on-premises and hybrid configurations should install the updates immediately, without waiting for public exploits to appear. The presence of three CVSS 10.0 vulnerabilities in a single update cycle, as well as a second critical patch for Campaign Classic in less than two weeks, is ample reason for emergency rather than scheduled updating.
