Loading story…
Adobe released security updates for Adobe ColdFusion and Adobe Campaign Classic to fix multiple vulnerabilities that could let attackers bypass security controls, manipulate files, gain elevated privileges, or execute arbitrary commands. The most severe issue, CVE-2026-48276, is an unrestricted file upload flaw in ColdFusion with a CVSS 10.0 rating that can lead to remote code execution, while CVE-2026-48315 is an improper input validation bug rated CVSS 9.3 that can enable privilege escalation.
CISA later added the ColdFusion flaw to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild and elevating the issue to an urgent remediation priority for organizations running internet-facing ColdFusion servers. Reporting on the KEV update said the vulnerability can contribute to full server compromise, and urged defenders to patch affected systems quickly, investigate for signs of compromise, and prioritize exposed web applications and related enterprise platforms over CVSS-only risk scoring.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Adobe released patches on August 11, 2026 for more than 50 vulnerabilities across multiple products, including priority 1 updates for ColdFusion and Campaign Classic. The ColdFusion fixes included critical flaws such as CVE-2026-48362, while Campaign Classic received fixes for three critical arbitrary code execution-related vulnerabilities; Adobe said it was not aware of in-the-wild exploitation.
CISA expanded its Known Exploited Vulnerabilities catalog to include an Adobe ColdFusion vulnerability among newly added flaws confirmed as exploited in the wild. The update elevated the issue as a high-priority remediation target for defenders.
Adobe released security updates for Adobe ColdFusion and Adobe Campaign Classic to remediate multiple vulnerabilities, including flaws that could allow unrestricted file upload, privilege escalation, file manipulation, and arbitrary command execution. The notice specifically highlighted CVE-2026-48276 in ColdFusion as a critical issue that could lead to remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcethecyberthrone.in
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt.org.eg
Open sourcehelpx.adobe.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe issued urgent ColdFusion updates after multiple severe vulnerabilities were disclosed across ColdFusion 2025 and 2023, including several flaws that can lead to arbitrary code execution. The most serious newly listed issue, **CVE-2026-48362**, is an unauthenticated OS command injection bug rated `CVSS 10.0`, while **CVE-2026-48273** was rated `9.9` for eval injection. Additional high-severity flaws include **CVE-2026-71387** (incorrect authorization, `CVSS 8.8`) and **CVE-2026-71386** (cross-site scripting, `CVSS 8.8`), alongside other issues affecting authorization, memory safety, denial of service, and sensitive memory exposure. Adobe said affected versions include ColdFusion 2025 up to `2025.0.11` and ColdFusion 2023 up to `2023.0.22`, and directed customers to upgrade to **2025.0.12** or **2023.0.23**. The warnings follow earlier reports that attackers rapidly exploited at least one maximum-severity ColdFusion flaw, **CVE-2026-48282**, a path traversal vulnerability that can enable arbitrary code execution without user interaction. Researchers said exploitation began within hours of public disclosure, and Shadowserver data cited **775** internet-exposed ColdFusion instances, highlighting the reachable attack surface. Adobe said it had not observed active exploitation of the latest August issues, but advised administrators to patch immediately, restrict access to the administrative network zone and portal, limit network exposure, monitor logs for unauthorized access attempts, and accelerate remediation as ColdFusion remains a high-value target.
Aug 12, 2026
Adobe disclosed two high-severity vulnerabilities in **ColdFusion** that affect versions **2023.18, 2025.6, and earlier**. The first, `CVE-2026-27304`, is an improper input validation flaw (`CWE-20`) that can lead to **arbitrary code execution** in the context of the current user without requiring user interaction. Adobe assigned the issue a CVSS v3.1 vector of `AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N` and published details in security bulletin **APSB26-38**. Adobe also disclosed `CVE-2026-27305`, a **path traversal** vulnerability (`CWE-22`) in the same ColdFusion versions that allows an unauthenticated remote attacker to perform **arbitrary file system reads** and access sensitive files outside intended directories. The flaw likewise requires no user interaction and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`, making the pair of issues a significant risk for exposed ColdFusion deployments.
Jun 30, 2026
Adobe ColdFusion is facing active exploitation of **CVE-2026-48282**, a maximum-severity flaw tied to **RDS arbitrary file write** that can be abused without privileges on unpatched servers. The Canadian Centre for Cyber Security warned that open-source reporting indicates in-the-wild attacks, while Adobe has issued security updates and urged administrators to patch immediately because of the high risk of compromise. Affected releases include **ColdFusion 2025.9, 2023.20, and earlier**, and internet scanning data from Shadowserver shows nearly **800** ColdFusion instances exposed online, though the number still vulnerable is unclear. Separate reporting on **CVE-2026-48276** highlights a closely related ColdFusion attack path in which an unauthenticated attacker uploads a malicious **CFML** payload through an unrestricted file-upload weakness, writes a web shell into a web-accessible location, and then triggers it with an HTTP request to gain code execution. That issue was described as critical with a **CVSS v3.1** score reflecting full impact to confidentiality, integrity, and availability, and its documented root causes included poor filename and extension validation and storing uploads under the web root. Public detection content has also appeared for **CVE-2026-48282**, underscoring defender focus on identifying exposed and unpatched ColdFusion systems.
Jul 12, 2026