# Adobe ColdFusion & Campaign Classic Priority 1 Patches for 12 Vulnerabilities Including Six Maximum-Severity RCE Flaws (APSB26-68, APSB26-69)

> Adobe published Priority 1 security bulletins APSB26-68 (ColdFusion 2025/2023) and APSB26-69 (Campaign Classic v7) addressing 12 CVEs, seven of which carry the maximum CVSS score of 10.0 and enable unauthenticated remote code execution via unrestricted file upload, improper input validation, path traversal, or incorrect authorization. Adobe states it is not aware of any exploits in the wild at time of disclosure and urges patching within 72 hours given the Priority 1 rating.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1091
- **ID:** TL-2026-1091
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48283, CVE-2026-48313, CVE-2026-48315, CVE-2026-48307, CVE-2026-48285, CVE-2026-48314, CVE-2026-48286

## Description

On 2026-06-30/07-01 Adobe released two coordinated Priority 1 security bulletins covering its ColdFusion application server and Campaign Classic marketing-automation platform. APSB26-68 addresses 11 CVEs in ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier), fixed in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21 respectively. Six of these reach the maximum CVSS score of 10.0: two unrestricted file upload flaws (CVE-2026-48276, CVE-2026-48283, CWE-434) that let an unauthenticated attacker drop and execute arbitrary files on the server; three improper input validation flaws (CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CWE-20) that achieve code execution via malformed requests; and one path traversal flaw (CVE-2026-48282, CWE-22) enabling arbitrary code execution. Additional high-severity issues in the same bulletin include a path traversal arbitrary file-read flaw (CVE-2026-48313, CVSS 9.3, CWE-22), a privilege escalation flaw (CVE-2026-48315, CVSS 9.3, CWE-20/CWE-269 class), a reflected XSS (CVE-2026-48307, CVSS 8.8, CWE-79), a server-side request forgery enabling security-feature bypass (CVE-2026-48285, CVSS 8.6, CWE-918), and a lower-severity path traversal privilege escalation (CVE-2026-48314, CVSS 6.5, CWE-22). All ColdFusion flaws require no special privileges or user interaction and are network-exploitable (AV:N). APSB26-69 addresses a single but maximum-severity flaw in Adobe Campaign Classic (ACC) v7: CVE-2026-48286 (CVSS 10.0), an incorrect authorization vulnerability (CWE-863) with remote code execution impact, exploitable over the network with no authentication and no user interaction. It affects ACC v7 7.4.3 build 9396 and earlier, fixed in build 9397, and applies only to on-premise and hybrid on-premise deployments — Adobe-hosted Campaign instances were already remediated server-side and require no customer action. Adobe explicitly states it is not aware of active exploitation of any of the 12 vulnerabilities at time of disclosure and has not observed public proof-of-concept code. Both products carry a documented history of exploitation: ColdFusion vulnerabilities (CVE-2023-29298, CVE-2023-29300, CVE-2023-38203, CVE-2023-26360) were exploited in the wild in 2023, including a confirmed intrusion at a U.S. federal civilian executive branch agency (CISA advisory AA23-339A) and deployment of the Behinder web shell via a deserialization flaw, underscoring that ColdFusion is a recurring target for opportunistic and targeted actors once technical details or working exploits surface. Given the Priority 1 rating, unauthenticated network attack vector, and this exploitation history, defenders should treat the 72-hour remediation window as a hard deadline and monitor for exploitation attempts even in the absence of current in-the-wild reports.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel

## Sources

- [SOCRadar: Adobe ColdFusion & Campaign Classic RCE Flaws](https://socradar.io/blog/adobe-coldfusion-campaign-classic-rce-flaws/)
- [Adobe Security Bulletin APSB26-68 (ColdFusion)](https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html)
- [Adobe Security Bulletin APSB26-69 (Campaign Classic)](https://helpx.adobe.com/security/products/campaign/apsb26-69.html)
- [BleepingComputer: Adobe patches seven max severity ColdFusion, Campaign flaws](https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/)
- [The Hacker News: Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic](https://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.html)
- [SecurityPointBreak: Adobe Patches 11 ColdFusion, Campaign Classic Flaws; Four Hit Max Severity](https://securitypointbreak.com/2026/06/30/adobe-patches-11-coldfusion-campaign-classic-flaws-four-hit-max-severity/)
- [Cyberpress: Adobe ColdFusion Critical Flaws Enable Arbitrary Code Execution and File Read Attacks](https://cyberpress.org/adobe-coldfusion-critical-flaws/)
- [CISA Cybersecurity Advisory AA23-339A: Threat Actors Exploit Adobe ColdFusion CVE-2023-26360](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-339a)
- [Qualys ThreatPROTECT: Adobe ColdFusion Vulnerabilities Exploited in Attacks Dropping Webshell (CVE-2023-29298, CVE-2023-29300, CVE-2023-38203)](https://threatprotect.qualys.com/2023/07/18/adobe-coldfusion-vulnerabilities-exploited-in-the-attacks-in-dropping-webshell-cve-2023-29298-cve-2023-29300-and-cve-2023-38203/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1091