Loading story…
Adobe has released Priority 1 security updates for ColdFusion and Adobe Campaign Classic to fix multiple high-severity vulnerabilities, including seven flaws rated CVSS 10.0. In ColdFusion, the patched issues affect versions 2025.9, 2023.20, and earlier, and include improper input validation (CVE-2026-48281, CVE-2026-48277), unrestricted file upload (CVE-2026-48276, CVE-2026-48283), and path traversal (CVE-2026-48282) bugs that could allow unauthenticated remote code execution without user interaction. Additional ColdFusion flaws include a path traversal issue with arbitrary file read and limited write access (CVE-2026-48313), an SSRF bug (CVE-2026-48285), and user-interaction issues such as reflected XSS (CVE-2026-48307) and improper input validation tied to malicious files (CVE-2026-48315).
Adobe also patched CVE-2026-48286 in Adobe Campaign Classic, an incorrect authorization flaw affecting version 7.4.3 and earlier that can lead to arbitrary code execution on on-premises instances. Adobe said it is not aware of in-the-wild exploitation of the specific vulnerabilities, but assigned the updates a Priority 1 rating, indicating they are being targeted or are at high risk of being targeted, and urged administrators to patch within 72 hours. Recommended versions include ColdFusion 2025 Update 10, ColdFusion 2023 Update 21, and Campaign Classic 7.4.4 / build 9397 or later.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Adobe announced it will move to a twice-monthly security bulletin schedule to speed delivery of security updates. The new cadence is set to begin on July 14, 2026.
Adobe directed users to update to ColdFusion 2025 Update 10, ColdFusion 2023 Update 21, and the latest Campaign Classic build, with Campaign Classic fixes available in version 7.4.3 build 9397 for Windows and Linux and remediation guidance to move to 7.4.4 or later. These versions were identified as containing fixes for the newly disclosed vulnerabilities.
Adobe released security updates addressing multiple vulnerabilities in ColdFusion and Campaign Classic, including seven CVSS 10.0 flaws. The company said it was not aware of active exploitation of the issues, but assigned the updates Priority 1 and urged rapid patching.
Multiple Adobe vulnerabilities were published, including critical ColdFusion flaws CVE-2026-48315, CVE-2026-48281, CVE-2026-48277, CVE-2026-48313, CVE-2026-48276, CVE-2026-48282, CVE-2026-48283, high-severity CVE-2026-48285, and Campaign Classic flaw CVE-2026-48286. The disclosures described impacts including remote code execution, path traversal, SSRF, and file upload issues affecting supported product versions and earlier releases.
Adobe ColdFusion reflected XSS vulnerability CVE-2026-48307 was published as affecting ColdFusion 2025.9, 2023.20, and earlier. The flaw requires user interaction and could enable malicious script injection leading to code execution in the current user's context.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcesocradar.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released a broad set of security updates covering **Adobe Experience Manager**, **Acrobat/Reader**, **ColdFusion**, **Dreamweaver**, **InDesign**, **InCopy**, **Substance 3D Sampler**, **Format Plugins**, **Campaign Classic**, and Content Credentials SDK components, prompting alerts from national and regional CERTs including Canada’s Cyber Centre and HKCERT. The advisories span multiple high-severity issues, with affected versions including **ColdFusion 2023.19 and 2025.8 and earlier**, **Dreamweaver 21.7 and earlier**, **Campaign Classic 7.4.3 build 9394 and earlier**, and **AEM Forms JEE LTS SP1 / 6.5.24.0 and earlier**. The most serious disclosures include multiple **remote code execution** bugs in Acrobat/Reader such as `CVE-2026-47911`, `CVE-2026-47912`, `CVE-2026-47913`, `CVE-2026-47914`, `CVE-2026-47915`, `CVE-2026-47918`, and `CVE-2026-47919`, largely tied to use-after-free conditions and malicious file handling; several **ColdFusion** flaws including `CVE-2026-47928`, `CVE-2026-47929`, `CVE-2026-47930`, `CVE-2026-47931`, and `CVE-2026-47932` that can enable code execution, security feature bypass, or unauthorized read/write access; **AEM Forms JEE** stored and reflected XSS issues `CVE-2026-34691` and `CVE-2026-34693`; **Campaign Classic** issues `CVE-2026-47938` and `CVE-2026-48303` involving SSRF, privilege escalation, and possible code execution; **Dreamweaver** arbitrary file read via `CVE-2026-47907`; and **USD Fileformat Plugins** heap-based buffer overflows `CVE-2026-48291` and `CVE-2026-48292`. Adobe has issued patches for the affected products, and defenders are being urged to review the vendor bulletins and deploy updates quickly.
Jun 29, 2026
Adobe disclosed two high-severity vulnerabilities in **ColdFusion** that affect versions **2023.18, 2025.6, and earlier**. The first, `CVE-2026-27304`, is an improper input validation flaw (`CWE-20`) that can lead to **arbitrary code execution** in the context of the current user without requiring user interaction. Adobe assigned the issue a CVSS v3.1 vector of `AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N` and published details in security bulletin **APSB26-38**. Adobe also disclosed `CVE-2026-27305`, a **path traversal** vulnerability (`CWE-22`) in the same ColdFusion versions that allows an unauthenticated remote attacker to perform **arbitrary file system reads** and access sensitive files outside intended directories. The flaw likewise requires no user interaction and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`, making the pair of issues a significant risk for exposed ColdFusion deployments.
Jun 30, 2026
Adobe has released security updates addressing several critical and high-severity vulnerabilities in ColdFusion versions 2025.4, 2023.16, 2021.22, and earlier. The vulnerabilities include improper input validation, improper access control, unrestricted upload of files with dangerous types, deserialization of untrusted data, and improper restriction of XML external entity references. These flaws could allow attackers to bypass security features, gain unauthorized read and write access, execute arbitrary code, escalate privileges, and read sensitive files from the server. Most of these vulnerabilities can be exploited remotely and do not require user interaction, with some specifically requiring high-privileged access. Adobe's security bulletin (APSB25-105) confirms that there are currently no known exploits in the wild for these issues. The company strongly recommends users update to the latest versions—ColdFusion 2025 Update 5, 2023 Update 17, and 2021 Update 23—to mitigate the risks. Additional guidance includes using the latest MySQL Java connector and reviewing updated serial filter documentation to protect against insecure deserialization attacks. Organizations using affected ColdFusion versions should prioritize patching to prevent potential exploitation of these vulnerabilities.
Jun 29, 2026