# Adobe Patches Nine CVSS 10.0/9.3 Flaws in ColdFusion and Campaign Classic Enabling Arbitrary Code Execution (APSB26-68, APSB26-69)

> Adobe's APSB26-68 and APSB26-69 bulletins (June 30, 2026) patch nine critical vulnerabilities: six CVSS 10.0 unauthenticated RCE flaws in ColdFusion 2023 (≤ Update 20) / 2025 (≤ Update 9) via unrestricted file upload (CWE-434), improper input validation (CWE-20), and path traversal (CWE-22); two CVSS 9.3 ColdFusion flaws for arbitrary file read and privilege escalation; and a CVSS 10.0 incorrect-authorization flaw (CWE-863) in Campaign Classic v7 ≤ 7.4.3 build 9396 enabling arbitrary code execution. Adobe assigned Priority Rating 1 and recommends patching within 72 hours despite finding no evidence of active exploitation.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1048
- **ID:** TL-2026-1048
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48276, CVE-2026-48283, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48313, CVE-2026-48315, CVE-2026-48286

## Description

On June 30, 2026, Adobe published two Priority-1 security bulletins covering eleven vulnerabilities across two enterprise products. APSB26-68 addresses Adobe ColdFusion, a widely deployed Java-based (JRun/CFML) web application server, fixing eleven flaws in ColdFusion 2023 (Update 20 and earlier) and ColdFusion 2025 (Update 9 and earlier). Six of these carry the maximum CVSS 3.1 base score of 10.0: CVE-2026-48276 and CVE-2026-48283 (unrestricted upload of dangerous file types, CWE-434) allow an unauthenticated remote attacker to upload and execute arbitrary files; CVE-2026-48277, CVE-2026-48281, and CVE-2026-48316 (improper input validation, CWE-20) and CVE-2026-48282 (path traversal, CWE-22) independently achieve full unauthenticated remote code execution with low attack complexity and no user interaction. Two additional ColdFusion flaws are rated CVSS 9.3: CVE-2026-48313 (path traversal, CWE-22) permits arbitrary file-system read, and CVE-2026-48315 (improper input validation, CWE-20) enables privilege escalation. APSB26-69 addresses Adobe Campaign Classic (ACC), an on-premise marketing-automation platform: CVE-2026-48286, an incorrect authorization flaw (CWE-863) rated CVSS 10.0, allows arbitrary code execution in ACC v7 build 7.4.3.9396 and earlier; the flaw is fixed in build 7.4.3.9397. Only on-premise Campaign Classic deployments require action — Adobe-hosted instances were already patched. Adobe credits researchers Anirudh Anand, Matan Sandori, and the '2Bsecure' team with several of the ColdFusion findings. Adobe states it is not aware of any public proof-of-concept or in-the-wild exploitation of these specific nine CVEs at time of publication, but assigned Priority Rating 1 to both bulletins, its highest urgency tier, reflecting the CVSS 10.0 unauthenticated-RCE nature of six of the flaws and ColdFusion's well-documented history as a high-value target: CISA and the FBI previously issued joint advisory AA23-339A after threat actors exploited CVE-2023-26360 (improper access control) for initial access into a Federal Civilian Executive Branch agency in June 2023, and separate campaigns abused the CVE-2023-29300 Java deserialization flaw to deploy the Behinder web shell against at least 66 ColdFusion servers in Japan across healthcare, education, and manufacturing sectors. Over the past five years CISA has catalogued 79 Adobe product vulnerabilities as actively exploited, ten of them abused by ransomware operations, underscoring the urgency of Adobe's 72-hour patch recommendation for this bulletin. Adobe also announced a shift to a twice-monthly security-bulletin cadence beginning July 14, 2026, intended to accelerate patch delivery for future vulnerabilities.

## MITRE ATT&CK

- T1596 Search Open Technical Databases
- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer

## Sources

- [Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion, Campaign Classic](https://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.html)
- [Adobe Security Bulletin APSB26-68 (ColdFusion)](https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html)
- [Adobe Security Bulletin APSB26-69 (Campaign Classic)](https://helpx.adobe.com/security/products/campaign/apsb26-69.html)
- [Adobe patches seven max severity ColdFusion, Campaign flaws](https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/)
- [Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities](https://www.securityweek.com/adobe-patches-critical-coldfusion-campaign-classic-vulnerabilities/)
- [Adobe ColdFusion Critical Vulnerabilities Let Attackers Execute Arbitrary Code](https://gbhackers.com/adobe-coldfusion-critical-vulnerabilities/)
- [Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers (AA23-339A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-339a)
- [CVE-2023-29300: Adobe ColdFusion Vulnerability](https://teamt5.org/en/posts/alerts-of-exploiting-adobe-cold-fusion-cve-2023-29300/)
- [Rapid7 Observed Exploitation of Adobe ColdFusion](https://www.rapid7.com/blog/post/2023/03/21/etr-rapid7-observed-exploitation-of-adobe-coldfusion/)
- [Adobe ColdFusion Vulnerabilities Exploited in the Attacks in Dropping Webshell (CVE-2023-29298, CVE-2023-29300, CVE-2023-38203)](https://threatprotect.qualys.com/2023/07/18/adobe-coldfusion-vulnerabilities-exploited-in-the-attacks-in-dropping-webshell-cve-2023-29298-cve-2023-29300-and-cve-2023-38203/)
- [TeamT5 Releases Latest Developments on Active Exploitation of Adobe ColdFusion Vulnerability (RH-ISAC)](https://rhisac.org/threat-intelligence/adobe-coldfusion-vulnerability/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1048