cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Adobe Urges Immediate Patching for Critical ColdFusion and Campaign Classic Flaws

· Original article ↗

Summary

Adobe patched more than 50 vulnerabilities, including critical ColdFusion and Campaign Classic flaws that could enable code execution. It says it is unaware of exploitation in the wild and urges immediate patching of those products.

Key points

  • ColdFusion’s priority 1 update fixes 15 flaws, including critical OS command injection CVE-2026-48362, eval injection CVE-2026-48273, and authorization flaw CVE-2026-71384.
  • Campaign Classic’s priority 1 update fixes three critical flaws that could enable arbitrary code execution, including SQL injection CVE-2026-48381.
  • Adobe urges users to apply the ColdFusion and Campaign Classic patches immediately because its priority 1 rating indicates greater risk of in-the-wild targeting.
  • Commerce fixes seven vulnerabilities, including privilege-escalation flaw CVE-2026-71362; Adobe recommends applying that priority 2 update within 30 days.
  • Adobe says it is unaware of in-the-wild exploitation of the newly addressed vulnerabilities.

Article Details

Vulnerability Types
  • OS command injection
  • Eval injection
  • Incorrect authorization
  • SQL injection
Severity
Critical; specified CVSS scores range from 9.0 to 10.0.
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-27302Adobe · Campaignflaws leading to arbitrary code execution: two incorrect authorization issues, CVE-2026-71398 and CVE-2026-27302 (CVSS score of 10/10), and an SQL injection bug, CVE-2026-48381 (CVSS score of 9.0/10).CVE-2026-48273Adobe · Coldfusionan OS command injection tracked as CVE-2026-48362 (CVSS score of 10/10), an eval injection tracked as CVE-2026-48273 (CVSS score of 9.9/10), and an incorrect authorization tracked as CVE-2026-71384 (CVSS score ofCVE-2026-48362Adobe · ColdfusionThese include an OS command injection tracked as CVE-2026-48362 (CVSS score of 10/10), an eval injection tracked as CVE-2026-48273 (CVSS score of 9.9/10), and an incorrect authorization tracked as CVE-2026-71384 (CVSSCVE-2026-48381Adobe · Campaignissues, CVE-2026-71398 and CVE-2026-27302 (CVSS score of 10/10), and an SQL injection bug, CVE-2026-48381 (CVSS score of 9.0/10).CVE-2026-71362Adobe · Adobe Commerce; Adobe · Adobe Commerce B2B; +1 moreAdobe resolved seven vulnerabilities in Commerce, including CVE-2026-71362 (CVSS score of 9.1/10), an incorrect authorization issue leading to privilege escalation. High-severity code execution and security featureCVE-2026-71384Adobe · Coldfusioninjection tracked as CVE-2026-48273 (CVSS score of 9.9/10), and an incorrect authorization tracked as CVE-2026-71384 (CVSS score of 9.6/10).CVE-2026-71398Adobe · Campaignthree critical flaws leading to arbitrary code execution: two incorrect authorization issues, CVE-2026-71398 and CVE-2026-27302 (CVSS score of 10/10), and an SQL injection bug, CVE-2026-48381 (CVSS score of

Vendors

AdobeAdobe on Tuesday rolled out patches for over 50 vulnerabilities across its products, including critical-severity bugs in ColdFusion, Campaign Classic, and Commerce.

Products

Adobe Campaign ClassicAdobe on Tuesday rolled out patches for over 50 vulnerabilities across its products, including critical-severity bugs in ColdFusion, Campaign Classic, and Commerce.Adobe ColdFusionAdobe on Tuesday rolled out patches for over 50 vulnerabilities across its products, including critical-severity bugs in ColdFusion, Campaign Classic, and Commerce.Adobe CommerceAdobe on Tuesday rolled out patches for over 50 vulnerabilities across its products, including critical-severity bugs in ColdFusion, Campaign Classic, and Commerce.Content CredentialsOn Tuesday, Adobe also rolled out patches for 11 high-severity defects in Lightroom and 15 high- and medium-severity bugs in Content Credentials.LightroomOn Tuesday, Adobe also rolled out patches for 11 high-severity defects in Lightroom and 15 high- and medium-severity bugs in Content Credentials.

Related Articles