Loading story…
Adobe has released security updates addressing several critical and high-severity vulnerabilities in ColdFusion versions 2025.4, 2023.16, 2021.22, and earlier. The vulnerabilities include improper input validation, improper access control, unrestricted upload of files with dangerous types, deserialization of untrusted data, and improper restriction of XML external entity references. These flaws could allow attackers to bypass security features, gain unauthorized read and write access, execute arbitrary code, escalate privileges, and read sensitive files from the server. Most of these vulnerabilities can be exploited remotely and do not require user interaction, with some specifically requiring high-privileged access.
Adobe's security bulletin (APSB25-105) confirms that there are currently no known exploits in the wild for these issues. The company strongly recommends users update to the latest versions—ColdFusion 2025 Update 5, 2023 Update 17, and 2021 Update 23—to mitigate the risks. Additional guidance includes using the latest MySQL Java connector and reviewing updated serial filter documentation to protect against insecure deserialization attacks. Organizations using affected ColdFusion versions should prioritize patching to prevent potential exploitation of these vulnerabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Adobe PSIRT disclosed CVE-2025-61808, CVE-2025-61809, CVE-2025-61810, CVE-2025-61811, CVE-2025-61812, and CVE-2025-61813, including critical file upload and input validation flaws and high-severity deserialization, access control, input validation, and XXE issues. The vulnerabilities could enable arbitrary code execution, unauthorized read/write access, or arbitrary file reads depending on the flaw.
Adobe published security advisory APSB25-105 covering multiple ColdFusion vulnerabilities affecting versions 2025.4, 2023.16, 2021.22, and earlier, and provided patched versions or update guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcehelpx.adobe.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe disclosed two high-severity vulnerabilities in **ColdFusion** that affect versions **2023.18, 2025.6, and earlier**. The first, `CVE-2026-27304`, is an improper input validation flaw (`CWE-20`) that can lead to **arbitrary code execution** in the context of the current user without requiring user interaction. Adobe assigned the issue a CVSS v3.1 vector of `AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N` and published details in security bulletin **APSB26-38**. Adobe also disclosed `CVE-2026-27305`, a **path traversal** vulnerability (`CWE-22`) in the same ColdFusion versions that allows an unauthenticated remote attacker to perform **arbitrary file system reads** and access sensitive files outside intended directories. The flaw likewise requires no user interaction and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`, making the pair of issues a significant risk for exposed ColdFusion deployments.
Jun 30, 2026
Adobe has released Priority 1 security updates for **ColdFusion** and **Adobe Campaign Classic** to fix multiple high-severity vulnerabilities, including seven flaws rated `CVSS 10.0`. In ColdFusion, the patched issues affect versions `2025.9`, `2023.20`, and earlier, and include improper input validation (`CVE-2026-48281`, `CVE-2026-48277`), unrestricted file upload (`CVE-2026-48276`, `CVE-2026-48283`), and path traversal (`CVE-2026-48282`) bugs that could allow unauthenticated remote code execution without user interaction. Additional ColdFusion flaws include a path traversal issue with arbitrary file read and limited write access (`CVE-2026-48313`), an SSRF bug (`CVE-2026-48285`), and user-interaction issues such as reflected XSS (`CVE-2026-48307`) and improper input validation tied to malicious files (`CVE-2026-48315`). Adobe also patched `CVE-2026-48286` in **Adobe Campaign Classic**, an incorrect authorization flaw affecting version `7.4.3` and earlier that can lead to arbitrary code execution on on-premises instances. Adobe said it is not aware of in-the-wild exploitation of the specific vulnerabilities, but assigned the updates a **Priority 1** rating, indicating they are being targeted or are at high risk of being targeted, and urged administrators to patch within 72 hours. Recommended versions include **ColdFusion 2025 Update 10**, **ColdFusion 2023 Update 21**, and **Campaign Classic 7.4.4 / build 9397 or later**.
Jul 2, 2026
Adobe released security advisories addressing multiple vulnerabilities across a range of its products, including ColdFusion, Adobe Experience Manager (AEM), DNG Software Development Kit (SDK), Acrobat, Acrobat Reader, and the Creative Cloud Desktop Application. The most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user, potentially enabling attackers to install programs, modify or delete data, or create new accounts with full user rights. Affected versions span ColdFusion 2025, 2023, and 2021, AEM Cloud Service and 6.5 LTS, DNG SDK 1.7.0 and prior, Acrobat and Acrobat Reader 2020 and 2024 for both Windows and Mac, and Creative Cloud Desktop Application 6.4.0.361 and earlier. Users and administrators are strongly encouraged to review the official advisories and apply the necessary updates to mitigate risk. Threat intelligence at the time of disclosure indicated no reports of these vulnerabilities being exploited in the wild. The advisories emphasize that users with administrative privileges are at greater risk if exploited, and recommend prompt patching to reduce exposure. Organizations relying on Adobe products for document management, web application development, or digital asset workflows should prioritize these updates to prevent potential compromise through remote code execution vulnerabilities.
Jun 29, 2026