Provenance Record

Clear, well-structured News piece with appropriate technical depth. Standard sectioning (Overview, What We Know, Affected Versions and Fixes, Analysis, What We Don't Know). Every specific (CVE IDs, CVSS scores, CWE classes, product versions, build numbers) is attributed inline to a named source. Word count 549, within the News 400-1200 range.

All 6 source snapshots read from disk and verified against the article's claims. source-0.html.gz (BleepingComputer, archive_fallback, original 200): CONFIRMS the 'seven max severity ColdFusion/Campaign' framing, the verbatim Adobe quote 'is not aware of any exploits in the wild for any of the issues addressed in these updates', the Priority 1 rating, the 'within 72 hours' install recommendation, and Campaign Classic 7.4.3 build 9396 and earlier on-premises. source-1.html.gz (SecurityWeek): CONFIRMS 11 total ColdFusion defects, the six CVSS 10/10 ColdFusion CVEs (48276, 48277, 48281, 48282, 48283, 48316), CVE-2026-48313 and CVE-2026-48315 at CVSS 9.3, Campaign Classic build 9397 fix, and ColdFusion 2023 Update 21 / 2025 Update 10. source-2.html.gz (Security Affairs): CONFIRMS CVE-2026-48286 Campaign Classic CVSS 10.0 arbitrary code execution via an authorization weakness, the two ColdFusion updates, Adobe-hosted instances not affected, and no evidence of active exploitation. source-3.html.gz (Cyber Security News, archive_fallback, original 200): CONFIRMS the CWE classifications (48276/48283 unrestricted file upload CWE-434; 48277/48281/48316 improper input validation CWE-20; 48282 path traversal CWE-22), CVE-2026-48313 path traversal / arbitrary file read CVSS 9.3, and CVE-2026-48315 improper input validation enabling privilege escalation CVSS 9.3. source-4.html.gz (NVD CVE-2026-48282): CONFIRMS base score 10.0, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-22, affected versions 2025.9 / 2023.20 and earlier, verbatim 'arbitrary code execution in the context of the current user', and 'does not require user interaction'. source-5.html.gz (watchTowr Labs): CONFIRMS bulletin APSB26-68, the verbatim 'best guess is that the Arbitrary File Write was assigned CVE-2026-48282' / 'the Arbitrary File Read became CVE-2026-48313', and the RDS caveat (RDS not enabled by default; requires RDS enabled with authentication disabled). All quoted material is verbatim in the snapshots.

All CVE IDs, CVSS scores, CWE classes, affected products/versions, build numbers, and the two direct Adobe/watchTowr/NVD quotes match their cited snapshots exactly. No hallucinations or misattributions detected. The bidirectional source check passes: every URL cited in the body appears in article.sources.

APPROVE. A clean, well-sourced vulnerability-patch News item. All seven CVSS 10.0 CVEs, the eleven-total ColdFusion advisory count, the fix builds, and every direct quote are corroborated by the cited snapshots. Two sources (BleepingComputer, Cyber Security News) were captured via Archive.org fallback though the originals returned HTTP 200 — informational only; both snapshots are complete and confirm their attributed claims. No corrections required.