Adobe addressed seven maximum-severity vulnerabilities in ColdFusion (versions 2025.9, 2023.20, and earlier) and Campaign Classic (version 7.4.3 build 9396 and earlier). Six ColdFusion vulnerabilities (CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282) enable remote code execution without privileges or user interaction. The Campaign Classic vulnerability (CVE-2026-48286) permits arbitrary code execution in the current user's context on unpatched on-premises instances. Adobe has released security patches for all these issues and urges administrators to update promptly. Adobe-hosted Campaign instances are already patched for CVE-2026-48286. Adobe plans to increase the frequency of security bulletins to twice monthly starting July 14, 2026.

Successful exploitation of these vulnerabilities can lead to remote or arbitrary code execution on affected systems without requiring user interaction or privileges. This poses a significant risk of unauthorized system compromise. The vulnerabilities are rated maximum severity and priority 1 by Adobe, indicating a high likelihood of targeting. No active exploitation has been observed in the wild as of the advisory date.

Adobe has released official security patches for all identified vulnerabilities affecting ColdFusion and Campaign Classic. Administrators should apply these updates as soon as possible, ideally within 72 hours, to mitigate the risk. For Campaign Classic, on-premises customers must update their deployments; Adobe-hosted instances are already patched. No additional mitigation steps are indicated by Adobe beyond applying the provided patches.