# Adobe Patches Seven Priority-1 ColdFusion and Campaign Classic Flaws (CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48282, CVE-2026-48316, CVE-2026-48286)

> Adobe issued an out-of-band, Priority 1 security bulletin (APSB26-68) patching six maximum-severity (CVSS 10.0) vulnerabilities in ColdFusion 2025.9, 2023.20 and earlier that enable unauthenticated remote code execution, plus a separate maximum-severity Incorrect Authorization flaw (CVE-2026-48286) in on-premises Adobe Campaign Classic 7.4.3 build 9396 and earlier that allows arbitrary code execution in the current user's context. Adobe states it is not aware of any in-the-wild exploitation or public PoC for these issues at disclosure.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1034
- **ID:** TL-2026-1034
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48286

## Description

On 2026-06-30 Adobe published an out-of-band Priority 1 security bulletin addressing seven maximum-severity vulnerabilities across two enterprise products. Six of the flaws affect ColdFusion (versions 2025.9, 2023.20, and earlier): CVE-2026-48276 is an Unrestricted Upload of File with Dangerous Type (CWE-434) that allows an unauthenticated remote attacker to place an executable payload (e.g., a JSP/CFM web shell) on the server; CVE-2026-48277 and CVE-2026-48281 are Improper Input Validation (CWE-20) issues that similarly permit arbitrary code execution with no user interaction; CVE-2026-48282 is a Path Traversal (CWE-22) flaw allowing writes/reads outside the intended web root, which can be chained into arbitrary code execution; CVE-2026-48316 was reserved in NVD at time of disclosure but its technical detail (CWE/CVSS breakdown) had not yet been populated by NVD, so its exact mechanism is unconfirmed from primary sources and is tracked here as a documented gap rather than invented detail. All confirmed ColdFusion CVEs carry CVSS 3.1 base score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — network-reachable, low complexity, no privileges or user interaction required, full confidentiality/integrity/availability impact with scope change.

The seventh flaw, CVE-2026-48286, affects only the on-premises deployment of Adobe Campaign Classic (7.4.3 build 9396 and earlier) and is an Incorrect Authorization vulnerability (CWE-863) that allows arbitrary code execution in the context of the currently authenticated user — also rated CVSS 10.0. Campaign Classic cloud/SaaS deployments are not affected.

All seven CVEs were assigned/published on 2026-06-30 and covered publicly by BleepingComputer on 2026-07-01. Adobe recommends patching within 72 hours given the low attack complexity and lack of required user interaction. No CVE in this batch appears in the CISA Known Exploited Vulnerabilities (KEV) catalog as of research time, and no public proof-of-concept exploit code has been identified, consistent with Adobe's statement that this is a proactive, non-reactive patch cycle. This disclosure lands just ahead of Adobe's announced shift to a twice-monthly (2nd/4th Tuesday) patch cadence beginning 2026-07-14. ColdFusion and Campaign Classic are both historically frequent targets for opportunistic internet-wide scanning and exploitation once patches (and therefore N-day diffing opportunities) become public, so rapid patching is the primary mitigating action.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Web Shell
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1564.001 Hidden Files and Directories
- T1070.004 File Deletion
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Adobe patches seven max-severity ColdFusion, Campaign flaws](https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/)
- [NVD - CVE-2026-48276](https://nvd.nist.gov/vuln/detail/CVE-2026-48276)
- [NVD - CVE-2026-48277](https://nvd.nist.gov/vuln/detail/CVE-2026-48277)
- [NVD - CVE-2026-48281](https://nvd.nist.gov/vuln/detail/CVE-2026-48281)
- [NVD - CVE-2026-48282](https://nvd.nist.gov/vuln/detail/CVE-2026-48282)
- [NVD - CVE-2026-48316 (reserved, detail not yet published)](https://nvd.nist.gov/vuln/detail/CVE-2026-48316)
- [NVD - CVE-2026-48286](https://nvd.nist.gov/vuln/detail/CVE-2026-48286)
- [Adobe Security Bulletin APSB26-68 (ColdFusion)](https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html)
- [Adobe Security Bulletin APSB26-69 (Campaign Classic, CVE-2026-48286)](https://helpx.adobe.com/security/products/campaign/apsb26-69.html)
- [coldfusion.adobe.com blog - ColdFusion 2025/2023 June 2026 security updates now live](https://coldfusion.adobe.com/2026/06/now-live-coldfusion-2025-and-2023-june-2026-security-updates-2/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1034