Adobe Patches 7 CVSS 10.0 Flaws in Cold Fusion and Campaign Classic
Summary: Adobe released patches for maximum-severity flaws in ColdFusion and Campaign Classic, including CVE-2026-48286, a CVSS 10.0 incorrect authorization bug in Campaign Classic that allows arbitrary code execution and affects on-premise instances up to ACC v7 7.4.3 build 9396. ColdFusion fixes shipped in 2023 Update 21 and 2025 Update 10, and Adobe said it has found no exploits in the wild, though the ColdFusion path traversal flaw CVE-2026-48282 saw an exploitation attempt from an India-geolocated IP within hours of disclosure.
What you should know: CVE-2026-48286 scores 10.0 and only spares Adobe-hosted customers, so every on-premise Campaign Classic deployment carries the full weight of an arbitrary code execution flaw until it reaches build 9397. Adobe is also moving to twice-monthly bulletins starting July 14, 2026, because AI-accelerated discovery is compressing the gap between disclosure and exploitation from days to hours.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-48276CVE-2026-48282CVE-2026-48283CVE-2026-48286CVE-2026-48307CVE-2026-48313
- Related
- ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More Cyber Risks ·CVE-2026-48282: Adobe Cold Fusion Path Traversal Vulnerability Known Exploited Vulnerabilities · Jul 07, 2026