# Adobe Patches Critical RCE Flaws in ColdFusion, Campaign Classic, and Commerce (CVE-2026-48362, CVSS 10.0)

> Adobe's August 11, 2026 Priority 1 security updates fix 15 ColdFusion defects (3 critical, including CVE-2026-48362, an OS command injection scoring CVSS 10.0), three critical Campaign Classic flaws (two CVSS 10.0 authorization bypasses and one CVSS 9.0 SQL injection), and one CVSS 9.1 Commerce privilege-escalation flaw, all leading to arbitrary code execution or unauthorized access. Adobe reports no known in-the-wild exploitation of this specific CVE bundle, but assigns it the same Priority 1 designation it gave the actively-exploited ColdFusion RDS flaw (CVE-2026-48282, added to CISA KEV on 2026-07-07) six weeks earlier, reflecting the platform's established pattern of rapid n-day weaponization.

- **Published:** 2026-08-11T00:00:00Z
- **Last reviewed:** 2026-08-12T16:14:23.366Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1985
- **ID:** TL-2026-1985
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48362, CVE-2026-48273, CVE-2026-71384, CVE-2026-71398, CVE-2026-27302, CVE-2026-48381, CVE-2026-71362, CVE-2026-71387, CVE-2026-71386, CVE-2026-48440, CVE-2026-34635, CVE-2026-48386, CVE-2026-21279, CVE-2026-48282

## Description

On August 11, 2026, Adobe shipped a wave of Priority 1 and Priority 2 security bulletins covering three enterprise products. ColdFusion received fixes for 15 vulnerabilities, three of them critical: CVE-2026-48362 (CVSS 10.0), an unauthenticated OS command injection permitting arbitrary code execution on the underlying server; CVE-2026-48273 (CVSS 9.9), an eval-injection flaw allowing attacker-controlled expressions to be evaluated server-side; and CVE-2026-71384 (CVSS 9.6), an incorrect-authorization defect that lets an attacker bypass access controls to reach privileged functionality. Campaign Classic, Adobe's on-premises marketing-automation/CDP platform, received fixes for three critical flaws: CVE-2026-71398 and CVE-2026-27302 (both CVSS 10.0, incorrect authorization leading to arbitrary code execution) and CVE-2026-48381 (CVSS 9.0, SQL injection). Adobe Commerce (Magento) received a Priority 2 fix for CVE-2026-71362 (CVSS 9.1), an incorrect-authorization flaw enabling privilege escalation.

Adobe states it is not aware of any exploitation in the wild for any of the newly disclosed defects, but assigned Priority 1 to both ColdFusion and Campaign Classic, its internal designation reserved for flaws Adobe judges to carry a higher risk of imminent targeting once technical details or patch diffs become available. This assessment is grounded in recent history: ColdFusion has been the subject of repeated maximum-severity bulletins throughout 2026 (APSB26-68 on 2026-06-30, seven CVSS-10.0 flaws including CVE-2026-48282, a Remote Development Services (RDS) FILEIO path-traversal bug that CISA added to the Known Exploited Vulnerabilities catalog on 2026-07-07 after confirming limited in-the-wild attacks), and Campaign Classic has independently drawn two other maximum-severity authorization-bypass bulletins in the six weeks preceding this one (CVE-2026-48286 in APSB26-69/July 2026; CVE-2026-48331/48323/48330 in APSB26-120 on 2026-08-03). The RDS/CKEditor exploitation chain documented for the actively-exploited CVE-2026-48282 (crafted RDS FILEIO packets against `/CFIDE/main/ide.cfm?ACTION=FILEIO` for arbitrary file read/write, and path-traversal in the CKEditor file-manager upload endpoint) illustrates the class of post-exploitation behavior — arbitrary file write to drop a CFML web shell, executing with NT AUTHORITY\SYSTEM privileges — that the same underlying platform has already suffered, and represents the realistic worst case for this new, not-yet-exploited CVE bundle should a public PoC emerge.

Adobe formalized a twice-monthly security-bulletin cadence effective 2026-07-14, and continues to ship an Isolated Patch mechanism for Commerce/Magento merchants to apply fixes with reduced integration risk. Defenders running any of the three affected products should treat immediate patching as the priority given the Priority 1 rating, even absent confirmed exploitation, because Adobe's own track record this year shows the gap between disclosure and active exploitation of its ColdFusion/Campaign Classic products has been measured in single-digit days.

## MITRE ATT&CK

- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1082 System Information Discovery
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1595.002 Active Scanning
- T1592.002 Gather Victim Host Information
- T1596.005 Search Open Technical Databases
- T1588.006 Obtain Capabilities
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion
- T1213.004 Data from Information Repositories
- T1499.004 Endpoint Denial of Service
- T1204.001 User Execution: Malicious Link
- T1552.001 Unsecured Credentials: Credentials In Files
- T1210 Exploitation of Remote Services
- T1499 Endpoint Denial of Service
- T1486 Data Encrypted for Impact

## Sources

- [Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws](https://www.securityweek.com/adobe-urges-immediate-patching-of-critical-coldfusion-campaign-classic-flaws/)
- [APSB26-68 - Adobe Security Bulletin (ColdFusion, RDS/CKEditor RCE incl. actively-exploited CVE-2026-48282)](https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html)
- [It's 37oC, And All We Can Think About Is ColdFusion (APSB26-68 CVE Bonanza)](https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/)
- [Vulnerability Summary for the Week of June 29, 2026](https://www.cisa.gov/news-events/bulletins/sb26-187)
- [CVE-2026-48282: Adobe ColdFusion RCE Actively Exploited](https://www.greenbone.net/en/blog/cve-2026-48282-adobe-coldfusion-actively-exploited/)
- [Attackers exploit critical Adobe ColdFusion vulnerability (CVE-2026-48282)](https://www.helpnetsecurity.com/2026/07/07/adobe-coldfusion-cve-2026-48282-exploitation-detected/)
- [Adobe patches seven max severity ColdFusion, Campaign flaws](https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/)
- [Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic](https://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.html)
- [Security updates available for Adobe Campaign Classic | APSB26-120](https://helpx.adobe.com/security/products/campaign/apsb26-120.html)
- [APSB26-73: Adobe Commerce July 2026 Security Update](https://helpx.adobe.com/security/products/magento/apsb26-73.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1985