Loading story…
Adobe disclosed two high-severity vulnerabilities in ColdFusion that affect versions 2023.18, 2025.6, and earlier. The first, CVE-2026-27304, is an improper input validation flaw (CWE-20) that can lead to arbitrary code execution in the context of the current user without requiring user interaction. Adobe assigned the issue a CVSS v3.1 vector of AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N and published details in security bulletin APSB26-38.
Adobe also disclosed CVE-2026-27305, a path traversal vulnerability (CWE-22) in the same ColdFusion versions that allows an unauthenticated remote attacker to perform arbitrary file system reads and access sensitive files outside intended directories. The flaw likewise requires no user interaction and carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, making the pair of issues a significant risk for exposed ColdFusion deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Adobe disclosed CVE-2026-27306, an improper input validation flaw in ColdFusion 2023.18, 2025.6, and earlier that could lead to arbitrary code execution in the current user's context. Adobe said exploitation requires elevated privileges and user interaction, including opening a malicious file, and referenced the issue in advisory APSB26-38.
Adobe disclosed two high-severity ColdFusion vulnerabilities, CVE-2026-27304 and CVE-2026-27305, affecting ColdFusion 2023.18, 2025.6, and earlier versions. The flaws can enable arbitrary code execution and arbitrary file read respectively without user interaction, and were referenced in Adobe advisory APSB26-38.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
helpx.adobe.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe has released security updates addressing several critical and high-severity vulnerabilities in ColdFusion versions 2025.4, 2023.16, 2021.22, and earlier. The vulnerabilities include improper input validation, improper access control, unrestricted upload of files with dangerous types, deserialization of untrusted data, and improper restriction of XML external entity references. These flaws could allow attackers to bypass security features, gain unauthorized read and write access, execute arbitrary code, escalate privileges, and read sensitive files from the server. Most of these vulnerabilities can be exploited remotely and do not require user interaction, with some specifically requiring high-privileged access. Adobe's security bulletin (APSB25-105) confirms that there are currently no known exploits in the wild for these issues. The company strongly recommends users update to the latest versions—ColdFusion 2025 Update 5, 2023 Update 17, and 2021 Update 23—to mitigate the risks. Additional guidance includes using the latest MySQL Java connector and reviewing updated serial filter documentation to protect against insecure deserialization attacks. Organizations using affected ColdFusion versions should prioritize patching to prevent potential exploitation of these vulnerabilities.
Jun 29, 2026
Adobe has released Priority 1 security updates for **ColdFusion** and **Adobe Campaign Classic** to fix multiple high-severity vulnerabilities, including seven flaws rated `CVSS 10.0`. In ColdFusion, the patched issues affect versions `2025.9`, `2023.20`, and earlier, and include improper input validation (`CVE-2026-48281`, `CVE-2026-48277`), unrestricted file upload (`CVE-2026-48276`, `CVE-2026-48283`), and path traversal (`CVE-2026-48282`) bugs that could allow unauthenticated remote code execution without user interaction. Additional ColdFusion flaws include a path traversal issue with arbitrary file read and limited write access (`CVE-2026-48313`), an SSRF bug (`CVE-2026-48285`), and user-interaction issues such as reflected XSS (`CVE-2026-48307`) and improper input validation tied to malicious files (`CVE-2026-48315`). Adobe also patched `CVE-2026-48286` in **Adobe Campaign Classic**, an incorrect authorization flaw affecting version `7.4.3` and earlier that can lead to arbitrary code execution on on-premises instances. Adobe said it is not aware of in-the-wild exploitation of the specific vulnerabilities, but assigned the updates a **Priority 1** rating, indicating they are being targeted or are at high risk of being targeted, and urged administrators to patch within 72 hours. Recommended versions include **ColdFusion 2025 Update 10**, **ColdFusion 2023 Update 21**, and **Campaign Classic 7.4.4 / build 9397 or later**.
Jul 2, 2026
Adobe released security advisories addressing multiple vulnerabilities across a range of its products, including ColdFusion, Adobe Experience Manager (AEM), DNG Software Development Kit (SDK), Acrobat, Acrobat Reader, and the Creative Cloud Desktop Application. The most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user, potentially enabling attackers to install programs, modify or delete data, or create new accounts with full user rights. Affected versions span ColdFusion 2025, 2023, and 2021, AEM Cloud Service and 6.5 LTS, DNG SDK 1.7.0 and prior, Acrobat and Acrobat Reader 2020 and 2024 for both Windows and Mac, and Creative Cloud Desktop Application 6.4.0.361 and earlier. Users and administrators are strongly encouraged to review the official advisories and apply the necessary updates to mitigate risk. Threat intelligence at the time of disclosure indicated no reports of these vulnerabilities being exploited in the wild. The advisories emphasize that users with administrative privileges are at greater risk if exploited, and recommend prompt patching to reduce exposure. Organizations relying on Adobe products for document management, web application development, or digital asset workflows should prioritize these updates to prevent potential compromise through remote code execution vulnerabilities.
Jun 29, 2026