Loading story…
Adobe released security updates for ColdFusion and Adobe Campaign Classic to fix multiple critical vulnerabilities that could enable arbitrary code execution, security feature bypass, unauthorized read/write access, and denial of service. The most severe Campaign Classic issues include CVE-2026-71398 and CVE-2026-27302, both incorrect authorization flaws affecting v7 through 7.4.3 build 9399 and fixed in 7.4.4 build 9400; Adobe and downstream reporting said several Campaign Classic and ColdFusion bugs were rated as high as CVSS 10.0. Adobe also addressed CVE-2026-48381, an SQL injection flaw in Campaign Classic that can also lead to code execution without user interaction, while Adobe-hosted Campaign Classic instances were reported as already remediated and the fixes apply to fully on-premises and hybrid on-prem components.
Adobe also patched ColdFusion 2025 through 2025.0.11 and ColdFusion 2023 through 2023.0.22, with fixes in 2025.0.12 and 2023.0.23, for vulnerabilities including CVE-2026-71384, an incorrect authorization flaw with a CVSS 9.6 score that can bypass security controls and expose administrative functions. Additional updates covered Adobe Commerce/Magento, Lightroom Classic, and the Content Credentials SDK; in Lightroom Classic, CVE-2026-48441 could let a malicious file trigger path traversal and expose sensitive files when opened. Adobe assigned Priority 1 to the ColdFusion and Campaign Classic updates, urged administrators to patch within 72 hours, and said it had no evidence of active exploitation at the time of disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
On August 11, 2026, CISA added SSVC metadata to CVE-2026-48441, recording no known exploitation, non-automatable exploitation, and total technical impact.
On August 11, 2026, CISA added SSVC metadata to CVE-2026-48381, stating there was no known exploitation, exploitation would be automatable, and technical impact would be total.
Adobe PSIRT received CVE-2026-71398 on August 11, 2026 for Adobe Campaign Classic. The incorrect authorization flaw can enable arbitrary code execution without user interaction and affects v7 through 7.4.3 build 9399, while 7.4.4 build 9400 is unaffected.
On August 11, 2026, Adobe published CVE-2026-71384, a critical incorrect authorization flaw in ColdFusion that can bypass security features, enable unauthorized read/write access, and potentially cause application denial of service. Affected versions include ColdFusion 2025 through 2025.0.11 and 2023 through 2023.0.22, with fixes in 2025.0.12 and 2023.0.23.
Adobe PSIRT received CVE-2026-48441 on August 11, 2026 for Lightroom Classic. The path traversal flaw can allow arbitrary file reads when a victim opens a malicious file, affecting versions through 15.4.1 while 15.5 is unaffected.
Adobe received CVE-2026-48381 on August 11, 2026 for Adobe Campaign Classic. The SQL injection flaw can lead to arbitrary code execution, affects v7 through 7.4.3 build 9399, and is fixed in 7.4.4 build 9400.
Adobe received and recorded CVE-2026-27302 on August 11, 2026 for Adobe Campaign Classic. The incorrect authorization flaw can enable arbitrary code execution without user interaction and affects v7 through 7.4.3 build 9399, while 7.4.4 build 9400 is listed as unaffected.
In August 2026, Adobe patched CVE-2026-34651 in Adobe Campaign Classic, an SQL injection vulnerability with CVSS 8.6 that could allow arbitrary file system reads. The new reference identifies it as a separate flaw from the two CVSS 10.0 Campaign Classic issues already tracked.
Heise reported that since July 2026, Adobe has been publishing security updates twice per month instead of once per month.
In its patch disclosures, Adobe said there was no evidence that the newly disclosed vulnerabilities were being exploited in the wild at the time of release.
Adobe stated that the Campaign Classic fixes applied to fully on-premise deployments and on-premise components of hybrid deployments, while Adobe-hosted instances had already been remediated and required no customer action.
Adobe rated the ColdFusion and Campaign Classic updates as Priority 1, indicating a higher risk of malicious targeting, and advised administrators to apply the fixes within 72 hours.
Adobe released security updates covering ColdFusion, Campaign Classic, Commerce/Magento, Lightroom Classic, and Content Credentials SDK. The updates fixed multiple critical and high-severity flaws, including ColdFusion and Campaign Classic issues that could allow arbitrary code execution.
Less than two weeks before the latest advisory, Adobe released patches for Campaign Classic vulnerability CVE-2026-48449, a CVSS 10.0 issue that could result in arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecert.ug
Open sourcethehackernews.com
Open sourceacn.gov.it
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe has released Priority 1 security updates for **ColdFusion** and **Adobe Campaign Classic** to fix multiple high-severity vulnerabilities, including seven flaws rated `CVSS 10.0`. In ColdFusion, the patched issues affect versions `2025.9`, `2023.20`, and earlier, and include improper input validation (`CVE-2026-48281`, `CVE-2026-48277`), unrestricted file upload (`CVE-2026-48276`, `CVE-2026-48283`), and path traversal (`CVE-2026-48282`) bugs that could allow unauthenticated remote code execution without user interaction. Additional ColdFusion flaws include a path traversal issue with arbitrary file read and limited write access (`CVE-2026-48313`), an SSRF bug (`CVE-2026-48285`), and user-interaction issues such as reflected XSS (`CVE-2026-48307`) and improper input validation tied to malicious files (`CVE-2026-48315`). Adobe also patched `CVE-2026-48286` in **Adobe Campaign Classic**, an incorrect authorization flaw affecting version `7.4.3` and earlier that can lead to arbitrary code execution on on-premises instances. Adobe said it is not aware of in-the-wild exploitation of the specific vulnerabilities, but assigned the updates a **Priority 1** rating, indicating they are being targeted or are at high risk of being targeted, and urged administrators to patch within 72 hours. Recommended versions include **ColdFusion 2025 Update 10**, **ColdFusion 2023 Update 21**, and **Campaign Classic 7.4.4 / build 9397 or later**.
Jul 12, 2026
Adobe released security updates for multiple products, with the most urgent fixes addressing seven vulnerabilities in **ColdFusion**, **Adobe Commerce**, and **Adobe Campaign Classic**, including three **critical** flaws rated `CVSS 10.0`. The most severe issues affect ColdFusion and Campaign Classic and could allow **arbitrary code execution**, leading Adobe to assign those updates **Priority 1** because of the risk to enterprise and internet-facing deployments. Adobe said it had **no evidence of active exploitation** at the time of disclosure. The broader advisory also listed additional affected products, including **Adobe Commerce B2B**, **Magento Open Source**, **Lightroom Classic**, and several **Content Credentials** components. Adobe issued fixes including **ColdFusion 2025.0.12**, **ColdFusion 2023.0.23**, and **Adobe Campaign Classic v7 7.4.4 build 9400**, while noting that **Adobe-hosted Campaign Classic** instances had already been remediated. Government and industry notices urged administrators to review Adobe's PSIRT guidance and apply updates as they become available.
Aug 14, 2026
Adobe released security updates for 12 products, fixing 88 vulnerabilities across its portfolio, with the most urgent issues affecting **ColdFusion**. The ColdFusion advisory was rated **Priority 1** and addresses 13 flaws, including eight critical vulnerabilities that could allow **arbitrary code execution** or **privilege escalation** through path traversal, code injection, improper input validation, missing authentication, SQL injection, and incorrect authorization. The fixes are included in **ColdFusion 2025 Update 11** and **ColdFusion 2023 Update 22**. Adobe also patched critical vulnerabilities in **Commerce**, **Experience Manager**, and **Illustrator**, and said it is not aware of any of the newly addressed vulnerabilities being exploited in the wild.
Jul 15, 2026