Adobe Patches Three CVSS 10.0 Cold Fusion and Campaign Classic Flaws
Summary: Adobe released updates for critical vulnerabilities in ColdFusion, Commerce, and Campaign Classic that could allow arbitrary code execution and privilege escalation, with the ColdFusion and Campaign Classic fixes rated Priority 1. Adobe said there is no evidence of exploitation in the wild and recommended installing the updates within 72 hours, while noting the Campaign Classic updates apply only to fully on-premise deployments and on-premise components of hybrid deployments, as Adobe-hosted instances were already remediated.
Why it matters: The disclosure came less than two weeks after Adobe patched a maximum-severity Campaign Classic flaw (CVE-2026-48449, CVSS 10.0), and Sansec reports threat actors are already exploiting CVE-2026-71362 in Adobe Commerce and Magento Open Source to switch a customer session to another customer account and reach private customer data.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-48449CVE-2026-71362
- Related
- CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability Known Exploited Vulnerabilities · Sep 24, 2026