Threat reportVulnerabilityTL-2026-1091
Adobe ColdFusion & Campaign Classic Priority 1 Patches for 12 Vulnerabilities Including Six Maximum-Severity RCE Flaws (APSB26-68, APSB26-69)
Adobe ColdFusion & Campaign Classic Priority 1 Patches for (TL-2026-1091), also tracked as APSB26-68, is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-02. It has no confirmed attribution, affects Adobe ColdFusion 2025, references 12 CVEs (CVE-2026-48276, CVE-2026-48277, CVE-2026-48281), maps to 15 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 17 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 12Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-1091
- Threat ID
- TL-2026-1091
- Also known as
- APSB26-68, APSB26-69
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, retail, news - media, marketing
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Adobe ColdFusion & Campaign Classic Priority 1 Patches for
Malware and tooling: Behinder, Project Discovery PoC (2023 ColdFusion chain)
How Adobe ColdFusion & Campaign Classic Priority 1 Patches for works
Adobe published Priority 1 security bulletins APSB26-68 (ColdFusion 2025/2023) and APSB26-69 (Campaign Classic v7) addressing 12 CVEs, seven of which carry the maximum CVSS score of 10.0 and enable unauthenticated remote code execution via unrestricted file upload, improper input validation, path traversal, or incorrect authorization. Adobe states it is not aware of any exploits in the wild at time of disclosure and urges patching within 72 hours given the Priority 1 rating.
On 2026-06-30/07-01 Adobe released two coordinated Priority 1 security bulletins covering its ColdFusion application server and Campaign Classic marketing-automation platform. APSB26-68 addresses 11 CVEs in ColdFusion 2025 (Update 9 and earlier) and ColdFusion 2023 (Update 20 and earlier), fixed in ColdFusion 2025 Update 10 and ColdFusion 2023 Update 21 respectively. Six of these reach the maximum CVSS score of 10.0: two unrestricted file upload flaws (CVE-2026-48276, CVE-2026-48283, CWE-434) that let an unauthenticated attacker drop and execute arbitrary files on the server; three improper input validation flaws (CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CWE-20) that achieve code execution via malformed requests; and one path traversal flaw (CVE-2026-48282, CWE-22) enabling arbitrary code execution. Additional high-severity issues in the same bulletin include a path traversal arbitrary file-read flaw (CVE-2026-48313, CVSS 9.3, CWE-22), a privilege escalation flaw (CVE-2026-48315, CVSS 9.3, CWE-20/CWE-269 class), a reflected XSS (CVE-2026-48307, CVSS 8.8, CWE-79), a server-side request forgery enabling security-feature bypass (CVE-2026-48285, CVSS 8.6, CWE-918), and a lower-severity path traversal privilege escalation (CVE-2026-48314, CVSS 6.5, CWE-22). All ColdFusion flaws require no special privileges or user interaction and are network-exploitable (AV:N). APSB26-69 addresses a single but maximum-severity flaw in Adobe Campaign Classic (ACC) v7: CVE-2026-48286 (CVSS 10.0), an incorrect authorization vulnerability (CWE-863) with remote code execution impact, exploitable over the network with no authentication and no user interaction. It affects ACC v7 7.4.3 build 9396 and earlier, fixed in build 9397, and applies only to on-premise and hybrid on-premise deployments — Adobe-hosted Campaign instances were already remediated server-side and require no customer action. Adobe explicitly states it is not aware of active exploitation of any of the 12 vulnerabilities at time of disclosure and has not observed public proof-of-concept code. Both products carry a documented history of exploitation: ColdFusion vulnerabilities (CVE-2023-29298, CVE-2023-29300, CVE-2023-38203, CVE-2023-26360) were exploited in the wild in 2023, including a confirmed intrusion at a U.S. federal civilian executive branch agency (CISA advisory AA23-339A) and deployment of the Behinder web shell via a deserialization flaw, underscoring that ColdFusion is a recurring target for opportunistic and targeted actors once technical details or working exploits surface. Given the Priority 1 rating, unauthenticated network attack vector, and this exploitation history, defenders should treat the 72-hour remediation window as a hard deadline and monitor for exploitation attempts even in the absence of current in-the-wild reports.
MITRE ATT&CK techniques used in TL-2026-1091
Collection
Defense Evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1046 Network Service Discovery; T1083 File and Directory Discovery
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Persistence
T1505 Server Software Component
Credential Access
Resource Development
Reconnaissance
Affected products and versions in Adobe ColdFusion & Campaign Classic Priority 1 Patches for
- Adobe — ColdFusion 2025
Vulnerable versions: 2025 Update 9 and earlier
Fixed in: 2025 Update 10 - Adobe — ColdFusion 2023
Vulnerable versions: 2023 Update 20 and earlier
Fixed in: 2023 Update 21 - Adobe — Campaign Classic v7
Vulnerable versions: 7.4.3 build 9396 and earlier (on-premise/hybrid)
Fixed in: 7.4.3 build 9397
Remediation for Adobe ColdFusion & Campaign Classic Priority 1 Patches for
Patches
- ColdFusion 2025 Update 10
- ColdFusion 2023 Update 21
- Adobe Campaign Classic v7 7.4.3 build 9397
Immediate actions
- Apply ColdFusion 2025 Update 10 to all ColdFusion 2025 instances (Update 9 and earlier are vulnerable)
- Apply ColdFusion 2023 Update 21 to all ColdFusion 2023 instances (Update 20 and earlier are vulnerable)
- Apply Adobe Campaign Classic v7 7.4.3 build 9397 to all on-premise and hybrid on-premise ACC instances (build 9396 and earlier are vulnerable)
- Treat this as a Priority 1 / 72-hour patch window per Adobe's own guidance given the unauthenticated CVSS 10.0 RCE flaws
- Verify no unauthorized files exist in ColdFusion web-accessible upload directories following patch application
Workarounds
- No vendor-documented workaround exists; Adobe advises patching as the only remediation
- Where immediate patching is infeasible, isolate ColdFusion/Campaign Classic servers from untrusted network segments and disable file-upload-capable endpoints until patched
Longer-term hardening
- Restrict network exposure of ColdFusion administrator consoles and Campaign Classic management interfaces to trusted networks/VPN
- Deploy a WAF with rules for path traversal, oversized/anomalous multipart file uploads, and known ColdFusion exploit request patterns
- Enable file-integrity monitoring on ColdFusion webroot and CFIDE directories to detect webshell drops
- Adopt Adobe's shift to twice-monthly (bimonthly) security bulletins beginning 2026-07-14 into patch-cadence planning
- Maintain an accelerated patch SLA for internet-facing Java application servers given documented history of rapid weaponization of ColdFusion CVEs
CVEs associated with Adobe ColdFusion & Campaign Classic Priority 1 Patches for
CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48283, CVE-2026-48313, CVE-2026-48315, CVE-2026-48307, CVE-2026-48285, CVE-2026-48314, CVE-2026-48286
Weaknesses (CWE) in Adobe ColdFusion & Campaign Classic Priority 1 Patches for
Timeline of Adobe ColdFusion & Campaign Classic Priority 1 Patches for
- Adobe releases security updates for ColdFusion 2023, 2021, and 2018 fixing CVE-2023-29298, CVE-2023-29300, and CVE-2023-29301, with no exploitation reported at time of release (precedent for the 2026 bulletins).
- A proof-of-concept exploit chaining the newly patched ColdFusion CVEs is published by Project Discovery and subsequently taken down, illustrating how quickly PoC code can follow ColdFusion disclosures.
- CVE-2023-29298 and CVE-2023-38203 chained in the wild against Adobe ColdFusion, dropping web shells via PowerShell commands (Qualys ThreatPROTECT).
- Adobe issues an emergency out-of-band patch for CVE-2023-38203, a bypass of the CVE-2023-29300 fix, after active in-the-wild exploitation was confirmed within days of the original July 11 bulletin.
- Threat actors exploit Adobe ColdFusion CVE-2023-26360 to breach a U.S. federal civilian executive branch agency server.
- CISA publishes Cybersecurity Advisory AA23-339A detailing exploitation of CVE-2023-26360 against government servers.
- CISA adds CVE-2023-29300 and CVE-2023-38203 to the Known Exploited Vulnerabilities Catalog, setting a federal patch deadline of 2024-01-29.
- Adobe publishes Priority 1 bulletins APSB26-68 (ColdFusion, 11 CVEs) and APSB26-69 (Campaign Classic, 1 CVE), releasing ColdFusion 2025 Update 10, ColdFusion 2023 Update 21, and Campaign Classic v7.4.3 build 9397.
- Security researchers and outlets (SOCRadar, The Hacker News, BleepingComputer) publish independent write-ups summarizing the 12 CVEs and their maximum-severity RCE impact.
- Adobe's planned transition to twice-monthly (bimonthly) security bulletins takes effect, citing AI-accelerated vulnerability discovery and compressed exploitation windows.
Sources cited for Adobe ColdFusion & Campaign Classic Priority 1 Patches for
- SOCRadar: Adobe ColdFusion & Campaign Classic RCE Flaws
- Adobe Security Bulletin APSB26-68 (ColdFusion)
- Adobe Security Bulletin APSB26-69 (Campaign Classic)
- BleepingComputer: Adobe patches seven max severity ColdFusion, Campaign flaws
- The Hacker News: Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic
- SecurityPointBreak: Adobe Patches 11 ColdFusion, Campaign Classic Flaws; Four Hit Max Severity
- Cyberpress: Adobe ColdFusion Critical Flaws Enable Arbitrary Code Execution and File Read Attacks
- CISA Cybersecurity Advisory AA23-339A: Threat Actors Exploit Adobe ColdFusion CVE-2023-26360
- Qualys ThreatPROTECT: Adobe ColdFusion Vulnerabilities Exploited in Attacks Dropping Webshell (CVE-2023-29298, CVE-2023-29300, CVE-2023-38203)
Detection coverage for TL-2026-1091
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1091 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.