Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

Ravie LakshmananAug 12, 2026Vulnerability / Web Security

Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrar

Ravie LakshmananAug 12, 2026Vulnerability / Web Security

Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation.

The most severe of the flaws are listed below –

CVE-2026-48362 (CVSS score: 10.0) – An operating system command injection vulnerability in ColdFusion that could lead to arbitrary code execution (Fixed in 2025.0.12 and 2023.0.23)
CVE-2026-48273 (CVSS score: 9.9) – An eval injection vulnerability in ColdFusion that could lead to arbitrary code execution (Fixed in 2025.0.12 and 2023.0.23)
CVE-2026-71384 (CVSS score: 9.6) – An incorrect authorization vulnerability in ColdFusion that could lead to an application denial-of-service (Fixed in 2025.0.12 and 2023.0.23)
CVE-2026-71362 (CVSS score: 9.1) – An incorrect authorization vulnerability in Commerce that could lead to privilege escalation
CVE-2026-71398 (CVSS score: 10.0) – An incorrect authorization vulnerability in Campaign Classic that could lead to arbitrary code execution (Fixed in ACC v7 7.4.4 build 9400)
CVE-2026-27302 (CVSS score: 10.0) – An incorrect authorization vulnerability in Campaign Classic that could lead to arbitrary code execution (Fixed in ACC v7 7.4.4 build 9400)
CVE-2026-48381 (CVSS score: 9.0) – An SQL injection vulnerability in Campaign Classic that could lead to arbitrary code execution (Fixed in ACC v7 7.4.4 build 9400)

The updates for ColdFusion and Campaign Classic have a Priority 1 rating, which refers to vulnerabilities that have a higher risk of being targeted by malicious cyber attacks.

It’s worth noting that the Campaign Classic updates only apply to fully on-premise deployments and to the on-premise components of hybrid deployments. Adobe-hosted instances have already been remediated and require no customer action.

Although there is no evidence of these flaws being exploited in the wild, administrators are recommended to install the update as soon as possible, preferably within 72 hours.

The disclosure comes less than two weeks after Adobe released patches for a maximum-severity security flaw in Campaign Classic (CVE-2026-48449, CVSS score: 10.0) that could result in arbitrary code execution.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts