Adobe patched multiple critical vulnerabilities in ColdFusion (versions 2025 and 2023) and Campaign Classic (version 7.4.3 build 9397). The Campaign Classic vulnerability CVE-2026-48286 is an incorrect authorization flaw with a CVSS score of 10.0 that could lead to arbitrary code execution. ColdFusion updates address 11 vulnerabilities, including six with a CVSS score of 10.0 (CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48283) related to unrestricted file uploads, improper input validation, and path traversal. Other critical issues include path traversal and privilege escalation (CVE-2026-48313, CVE-2026-48315), cross-site scripting (CVE-2026-48307), SSRF (CVE-2026-48285), and medium severity path traversal (CVE-2026-48314). Adobe has assigned a priority rating of 1 to these updates, indicating high exploitation potential, though no active exploits are known. Users should apply ColdFusion 2025 Update 10, ColdFusion 2023 Update 21, and Campaign Classic 7.4.3 build 9397 to remediate these issues.

The vulnerabilities could allow attackers to execute arbitrary code, read arbitrary files, escalate privileges, bypass security features, and perform cross-site scripting attacks. This could lead to full compromise of affected systems running ColdFusion or Campaign Classic if exploited. The severity ratings of 10/10 for multiple vulnerabilities indicate critical risk. No public exploits are currently known, but Adobe considers the risk high enough to prioritize patching.

Adobe has released official patches for all identified vulnerabilities. Users should update to Adobe Campaign Classic version 7.4.3 build 9397, ColdFusion 2025 Update 10, and ColdFusion 2023 Update 21 as soon as possible. There are no indications that additional mitigations are required beyond applying these updates. Adobe manages remediation for these on-premises products; users must apply patches themselves.