Adobe Patches Seven Priority-1 ColdFusion and Campaign Classic Flaws (CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48282, CVE-2026-48316, CVE-2026-48286)

Adobe Patches Seven Priority-1 ColdFusion and Campaign (TL-2026-1034), also tracked as Adobe ColdFusion/Campaign Classic Priority 1 Update (June/July 2026), is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-01. It has no confirmed attribution, affects Adobe ColdFusion, references 6 CVEs (CVE-2026-48276, CVE-2026-48277, CVE-2026-48281), maps to 16 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1034

Threat ID
TL-2026-1034
Also known as
Adobe ColdFusion/Campaign Classic Priority 1 Update (June/July 2026), APSB26-68
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-01
Last reviewed
2026-07-01
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, enterprise-it, media-marketing
Target regions
Global
Detection rules
9
Indicators of compromise
18

Adobe issued an out-of-band, Priority 1 security bulletin (APSB26-68) patching six maximum-severity (CVSS 10.0) vulnerabilities in ColdFusion 2025.9, 2023.20 and earlier that enable unauthenticated remote code execution, plus a separate maximum-severity Incorrect Authorization flaw (CVE-2026-48286) in on-premises Adobe Campaign Classic 7.4.3 build 9396 and earlier that allows arbitrary code execution in the current user's context. Adobe states it is not aware of any in-the-wild exploitation or public PoC for these issues at disclosure.

How Adobe Patches Seven Priority-1 ColdFusion and Campaign works

On 2026-06-30 Adobe published an out-of-band Priority 1 security bulletin addressing seven maximum-severity vulnerabilities across two enterprise products. Six of the flaws affect ColdFusion (versions 2025.9, 2023.20, and earlier): CVE-2026-48276 is an Unrestricted Upload of File with Dangerous Type (CWE-434) that allows an unauthenticated remote attacker to place an executable payload (e.g., a JSP/CFM web shell) on the server; CVE-2026-48277 and CVE-2026-48281 are Improper Input Validation (CWE-20) issues that similarly permit arbitrary code execution with no user interaction; CVE-2026-48282 is a Path Traversal (CWE-22) flaw allowing writes/reads outside the intended web root, which can be chained into arbitrary code execution; CVE-2026-48316 was reserved in NVD at time of disclosure but its technical detail (CWE/CVSS breakdown) had not yet been populated by NVD, so its exact mechanism is unconfirmed from primary sources and is tracked here as a documented gap rather than invented detail. All confirmed ColdFusion CVEs carry CVSS 3.1 base score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — network-reachable, low complexity, no privileges or user interaction required, full confidentiality/integrity/availability impact with scope change.

The seventh flaw, CVE-2026-48286, affects only the on-premises deployment of Adobe Campaign Classic (7.4.3 build 9396 and earlier) and is an Incorrect Authorization vulnerability (CWE-863) that allows arbitrary code execution in the context of the currently authenticated user — also rated CVSS 10.0. Campaign Classic cloud/SaaS deployments are not affected.

All seven CVEs were assigned/published on 2026-06-30 and covered publicly by BleepingComputer on 2026-07-01. Adobe recommends patching within 72 hours given the low attack complexity and lack of required user interaction. No CVE in this batch appears in the CISA Known Exploited Vulnerabilities (KEV) catalog as of research time, and no public proof-of-concept exploit code has been identified, consistent with Adobe's statement that this is a proactive, non-reactive patch cycle. This disclosure lands just ahead of Adobe's announced shift to a twice-monthly (2nd/4th Tuesday) patch cadence beginning 2026-07-14. ColdFusion and Campaign Classic are both historically frequent targets for opportunistic internet-wide scanning and exploitation once patches (and therefore N-day diffing opportunities) become public, so rapid patching is the primary mitigating action.

MITRE ATT&CK techniques used in TL-2026-1034

Collection

T1005 Data from Local System

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Defense Evasion

T1070.004 File Deletion; T1564.001 Hidden Files and Directories

Discovery

T1083 File and Directory Discovery; T1518 Software Discovery

Command and Control

T1105 Ingress Tool Transfer

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Persistence

T1505.003 Web Shell

Credential Access

T1552.001 Credentials In Files

Resource Development

T1588.005 Exploits

Reconnaissance

T1595 Active Scanning

Affected products and versions in Adobe Patches Seven Priority-1 ColdFusion and Campaign

  • Adobe — ColdFusion
    Vulnerable versions: 2025.9 and earlier; 2023.20 and earlier
    Fixed in: ColdFusion 2025 Update 10; ColdFusion 2023 Update 21
  • Adobe — Campaign Classic (on-premises)
    Vulnerable versions: 7.4.3 build 9396 and earlier
    Fixed in: Update per Adobe Campaign Classic security bulletin APSB26-69 (CVE-2026-48286)

Remediation for Adobe Patches Seven Priority-1 ColdFusion and Campaign

Patches

  • Adobe APSB26-68 — ColdFusion (covers CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48282, CVE-2026-48316)
  • Adobe Security Bulletin APSB26-69 — Campaign Classic (covers CVE-2026-48286)

Immediate actions

  • Apply Adobe ColdFusion security update APSB26-68 to all 2025.9 and 2023.20 (and earlier) instances within Adobe's recommended 72-hour window
  • Apply the Adobe Campaign Classic security update covering CVE-2026-48286 to all on-premises 7.4.3 build 9396 and earlier deployments
  • Restrict internet exposure of ColdFusion administrator interfaces (/CFIDE/) and on-premises Campaign Classic consoles until patched

Workarounds

  • Restrict ColdFusion admin interface (/CFIDE/administrator) access to trusted/internal networks only
  • Disable or gate unused ColdFusion file-upload endpoints pending patch
  • Restrict on-premises Campaign Classic access to VPN/allow-listed source IPs until patched

Longer-term hardening

  • Deploy WAF/reverse-proxy rules blocking anomalous multipart file-upload requests and path-traversal sequences (../, encoded variants) to ColdFusion endpoints
  • Network-segment ColdFusion and Campaign Classic servers away from direct internet exposure; front with a reverse proxy/WAF
  • Enforce server-side file-upload allow-listing (extension + content-type + magic-byte validation) independent of vendor patch state
  • Add authorization-boundary monitoring/alerting for Campaign Classic on-prem deployments to catch incorrect-authorization abuse patterns
  • Track Adobe's new twice-monthly bulletin cadence (starting 2026-07-14) in patch-management SLAs

CVEs associated with Adobe Patches Seven Priority-1 ColdFusion and Campaign

CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48286

Weaknesses (CWE) in Adobe Patches Seven Priority-1 ColdFusion and Campaign

CWE-434, CWE-20, CWE-22, CWE-863

Timeline of Adobe Patches Seven Priority-1 ColdFusion and Campaign

  • Adobe issues APSB26-69 as a distinct Campaign Classic bulletin (separate from the ColdFusion APSB26-68 bulletin) to isolate CVE-2026-48286, reflecting the differing product and on-premises-only applicability.
  • Fixed ColdFusion builds (2025 Update 10 and 2023 Update 21) made available for download alongside APSB26-68, giving administrators immediate remediation without a separate rollout delay.
  • Fixed ColdFusion and Campaign Classic builds released concurrently with the advisories; no separate delayed-patch window.
  • Adobe publishes out-of-band Priority 1 security bulletin APSB26-68 covering six ColdFusion vulnerabilities; a separate Campaign Classic advisory covers CVE-2026-48286.
  • CVE-2026-48276, -48277, -48281, -48282, and -48286 published in NVD with CVSS 3.1 base score 10.0; CVE-2026-48316 reserved but not yet populated with technical detail.
  • TL-Intel Harness ingests the BleepingComputer article via its RSS backlog and opens threat record TL-2026-1034 for the HUNT/RESEARCH pipeline.
  • TL-Intel research confirms no CISA KEV listing and no public PoC identified for any of the six tracked CVEs as of publication.
  • BleepingComputer publishes coverage of the seven Priority 1 flaws, noting Adobe is not aware of in-the-wild exploitation.
  • End of Adobe's recommended 72-hour patch window from bulletin publication for affected ColdFusion and Campaign Classic instances.
  • Adobe's announced shift to a twice-monthly (2nd/4th Tuesday) security bulletin cadence takes effect, changing future patch-tracking rhythm for these product lines.

Sources cited for Adobe Patches Seven Priority-1 ColdFusion and Campaign

Threats related to Adobe Patches Seven Priority-1 ColdFusion and Campaign

Detection coverage for TL-2026-1034

As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1034 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats