Adobe Patches Seven Maximum-Severity ColdFusion and Campaign Classic Flaws, Each Rated CVSS 10.0 for Code Execution
Adobe's July 1 updates fix seven CVSS 10.0 flaws—six in ColdFusion, one in on-premises Campaign Classic—that can lead to arbitrary code execution.
Overview
Adobe released security updates on July 1, 2026 that fix seven maximum-severity vulnerabilities across its ColdFusion application server and its Campaign Classic marketing platform, according to BleepingComputer. Each of the seven carries the highest possible CVSS score of 10.0 and could lead to arbitrary code execution. As reported by SecurityWeek, six of the top-rated flaws affect ColdFusion and one affects Campaign Classic.
At the time of publication, Adobe said it had no evidence the bugs were being used in attacks. Per BleepingComputer, the company stated it “is not aware of any exploits in the wild for any of the issues addressed in these updates.”
What We Know
The six ColdFusion vulnerabilities rated CVSS 10.0 are CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48282, CVE-2026-48283, and CVE-2026-48316, according to SecurityWeek and Security Affairs. As detailed by Cyber Security News, CVE-2026-48276 and CVE-2026-48283 stem from the unrestricted upload of files with dangerous types; CVE-2026-48277, CVE-2026-48281, and CVE-2026-48316 are improper input validation flaws; and CVE-2026-48282 is a path traversal weakness leading to arbitrary code execution.
The seventh maximum-severity flaw, CVE-2026-48286, is in Campaign Classic and could let an attacker execute arbitrary code through an authorization weakness, according to Security Affairs.
For CVE-2026-48282, the National Vulnerability Database records a base score of 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H and classifies it under CWE-22, path traversal. The NVD entry notes that ColdFusion versions 2025.9, 2023.20 and earlier are affected by the flaw, which “could lead to arbitrary code execution in the context of the current user,” and states that exploiting the issue does not require user interaction.
Beyond the top-rated bugs, SecurityWeek reports the ColdFusion advisory addressed eleven vulnerabilities in total. These include CVE-2026-48313, a CVSS 9.3 path traversal flaw enabling arbitrary file reads, and CVE-2026-48315, a CVSS 9.3 improper input validation flaw allowing privilege escalation, both also noted by Cyber Security News.
Affected Versions and Fixes
Adobe addressed the ColdFusion flaws in ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10, according to Security Affairs. For Campaign Classic, SecurityWeek reports the fix lands in on-premises build 9397; Security Affairs notes that Adobe-hosted instances remain unaffected. BleepingComputer reports that the Campaign Classic issue affects versions 7.4.3 build 9396 and earlier, on premises only.
Adobe assigned the updates a Priority 1 rating and recommends administrators install them “within 72 hours,” according to BleepingComputer.
Analysis
ColdFusion has been a recurring target for attackers, and the volume of maximum-severity ratings in a single release is unusual. The security firm watchTowr Labs, which examined Adobe’s bulletin APSB26-68, offered a technical read on two of the flaws. In its analysis, watchTowr said its “best guess is that the Arbitrary File Write was assigned CVE-2026-48282,” while “the Arbitrary File Read became CVE-2026-48313.”
watchTowr also added an important caveat: per its write-up, that file-write and file-read pair sits in ColdFusion’s Remote Development Services (RDS) component and requires RDS to be explicitly enabled with authentication disabled—non-default configurations that narrow the real-world attack surface for those specific issues.
What We Don’t Know
Adobe’s bulletin does not detail how many organizations run vulnerable configurations, and the company has not published exploitation telemetry. Whether any of the seven maximum-severity flaws will be weaponized after disclosure remains to be seen; as of the updates’ release, Adobe reported no known in-the-wild exploitation, according to Security Affairs.