# Multi-Vendor Critical Patch Roundup: Firefox 152.0.6, Chrome 150, Adobe ColdFusion/Commerce/AEM (APSB26-68/73/74), and VMware Avi Load Balancer (VMSA-2026-0005)

> A coordinated wave of vendor security updates addresses critical flaws across Firefox (public exploit code for 2 CVEs), Chrome (2 critical Ozone use-after-free bugs), Adobe (12 CVEs across ColdFusion, Commerce/Magento, and Experience Manager, several CVSS >= 9.0 including one CVSS 10.0), and Broadcom/VMware's Avi Load Balancer (CVSS 9.8 unauthenticated control-plane authentication bypass discovered by NATO's Cyber Security Centre). No CVE in this batch is confirmed as actively exploited in the wild or added to CISA KEV as of this report.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-19T02:52:33.781Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1403
- **ID:** TL-2026-1403
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-15718, CVE-2026-15719, CVE-2026-15764, CVE-2026-15765, CVE-2026-48318, CVE-2026-48322, CVE-2026-48284, CVE-2026-48321, CVE-2026-48325, CVE-2026-48319, CVE-2026-48324, CVE-2026-48327, CVE-2026-48356, CVE-2026-48358, CVE-2026-48259, CVE-2026-48359, CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871

## Description

On 2026-07-01 through 2026-07-14, four major vendors released overlapping critical security updates, creating a compressed patch window for enterprise defenders. Mozilla shipped Firefox 152.0.6 (MFSA2026-67) fixing CVE-2026-15718 (invalid pointer in the JavaScript: WebAssembly engine) and CVE-2026-15719 (a site-isolation bypass in DOM: Navigation); Mozilla explicitly confirmed public exploit code exists for both but found no evidence of in-the-wild attacks. Google shipped Chrome 150.0.7871.124/125 fixing 15 flaws including two critical use-after-free bugs in Ozone (CVE-2026-15764, CVE-2026-15765), Chrome's Linux windowing/display abstraction layer; both require a victim to perform specific UI gestures on a crafted HTML page and can lead to heap corruption and potential remote code execution, alongside 12 high-severity bugs in Skia, Libyuv, V8, Media, GPU, and Core. Adobe released three parallel bulletins: APSB26-68 for ColdFusion, patching 8 critical flaws (CVE-2026-48318 CVSS 9.9 path traversal to RCE; CVE-2026-48322 CVSS 9.6 code injection; CVE-2026-48284 CVSS 9.6 improper input validation; CVE-2026-48321 CVSS 9.3 incorrect authorization/privesc; CVE-2026-48325 CVSS 9.3 missing authentication to RCE; CVE-2026-48319 CVSS 9.1 path traversal; CVE-2026-48324 CVSS 9.1 SQL injection to RCE; CVE-2026-48327 CVSS 9.0 incorrect authorization) remediated in ColdFusion 2025 Update 11 and 2023 Update 22; APSB26-73 for Adobe Commerce/Magento Open Source, patching CVE-2026-48358 (NVD-rated CVSS 10.0, unauthenticated zero-interaction improper output escaping in the webhooks component leading to arbitrary code execution) and CVE-2026-48356 (CVSS 9.6, arbitrary file upload to privilege escalation), affecting every supported 2.4.x line; and APSB26-74 for Adobe Experience Manager, patching CVE-2026-48259 (CVSS 9.6 SSRF to RCE) and CVE-2026-48359 (CVSS 9.6 XXE to RCE), both credited to Dylan Pindur, Adam Kues, and Patrik Grobshäuser of Assetnote. Finally, Broadcom published VMSA-2026-0005 for VMware Avi Load Balancer, addressing seven vulnerabilities (CVE-2026-47865 through CVE-2026-47871) spanning authentication bypass, remote code execution, privilege escalation, and directory traversal; the headline flaw, CVE-2026-47865 (CVSS 9.8), allows a network-positioned attacker with no credentials to bypass authentication and reach the Avi control plane, and was discovered by Filip Waeytens of NATO's technology and cyber hub. None of the 17 CVEs tracked in this roundup carries a confirmed in-the-wild exploitation report or CISA KEV listing at time of writing; the hunt rationale qualifies the cluster purely on CVSS/network-vector severity and the compressed multi-vendor patch timing that raises near-term weaponization risk, particularly for the unauthenticated ColdFusion, Commerce webhooks, and Avi Load Balancer flaws.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1189 Drive-by Compromise
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1212 Exploitation for Credential Access
- T1016 System Network Configuration Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1499 Endpoint Denial of Service
- T1565 Data Manipulation
- T1587 Develop Capabilities
- T1595 Active Scanning
- T1046 Network Service Discovery
- T1083 File and Directory Discovery
- T1136 Create Account
- T1489 Service Stop
- T1498 Network Denial of Service
- T1090 Proxy
- T1592.004 Gather Victim Host Information: Client Configurations
- T1583.006 Acquire Infrastructure: Web Services
- T1584.006 Compromise Infrastructure: Web Services
- T1566.002 Phishing: Spearphishing Link
- T1204.001 User Execution: Malicious Link
- T1685 Disable or Modify Tools
- T1217 Browser Information Discovery
- T1499.003 Endpoint Denial of Service: Application Exhaustion Flood
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1593 Search Open Websites/Domains

## Sources

- [Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws](https://thehackernews.com/2026/07/firefox-chrome-adobe-and-vmware-updates.html)
- [Security Vulnerabilities fixed in Firefox 152.0.6 (MFSA2026-67)](https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html)
- [Adobe Security Bulletin APSB26-68 (ColdFusion)](https://helpx.adobe.com/uk/security/products/coldfusion/apsb26-68.html)
- [Security update available for Adobe Commerce - APSB26-73](https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-37421)
- [Adobe Security Bulletin APSB26-74 (Experience Manager)](https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html)
- [7 Severe Vulnerabilities Patched in VMware Avi Load Balancer](https://www.securityweek.com/7-severe-vulnerabilities-patched-in-vmware-avi-load-balancer/)
- [Support Content Notification (VMSA-2026-0005)](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37926)
- [VMware Avi Load Balancer Vulnerabilities Let Attackers Bypass Authentication](https://cybersecuritynews.com/vmware-avi-load-balancer-vulnerabilities/)
- [Chrome 150 Security Update Patches 15 Flaws, Including Two Critical Code Execution Ones](https://cybersecuritynews.com/chrome-150-security-update/)
- [Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates](https://www.securityweek.com/critical-vulnerabilities-patched-with-fresh-chrome-150-firefox-152-updates/)
- [Adobe Patches Critical ColdFusion Vulnerabilities](https://www.securityweek.com/adobe-patches-critical-coldfusion-vulnerabilities/)
- [Adobe Releases Patches for ColdFusion Critical Vulnerabilities - Qualys ThreatPROTECT](https://threatprotect.qualys.com/2026/07/01/adobe-releases-patches-for-coldfusion-critical-vulnerabilities/)
- [Release Notes for Avi Load Balancer Version 31.2.2](https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/31-2/vmware-avi-load-balancer-release-notes/Release-notes-for-avi-load-balancer-version-31-2-2.html)
- [Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2026-067)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1403