{"id":1555,"date":"2026-07-01T17:05:14","date_gmt":"2026-07-01T17:05:14","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1555"},"modified":"2026-07-01T17:05:14","modified_gmt":"2026-07-01T17:05:14","slug":"adobe-patches-7-cvss-10-0-flaws-in-coldfusion-and-campaign-classic","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1555","title":{"rendered":"Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Jul 01, 2026<\/span><\/span><span class=\"p-tags\">Artificial Intelligence \/ Vulnerability<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiP2LpF3s-oL3WaiHtAZ9N33J120bvGnWDoQ39eE1fyToERHmJgkAtMzarRyW9-gOG0N4U1_nOEQmwg-3krYIZDcXXB6JYpurMezefSiM5-ygJd9CuuS1sS-gHNjoKgBRayO0wBow5GB1yaanR55TW2fwus6MQXwlqeXDJ2Xu7z2fiOGbPXo4qio4LpXZPO\/s1700-e365\/adobe.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Adobe has released patches for multiple maximum-severity security flaws impacting Adobe ColdFusion and Adobe Campaign Classic.<\/p>\n<p>The ColdFusion updates \u00abresolves critical and important vulnerabilities\u202fthat could lead to\u202farbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass,\u00bb Adobe said in an alert released Tuesday.<\/p>\n<p>The <a href=\"https:\/\/helpx.adobe.com\/security\/products\/coldfusion\/apsb26-68.html\">vulnerabilities<\/a> are listed below &#8211;<\/p>\n<ul>\n<li><b>CVE-2026-48276, CVE-2026-48283<\/b> (CVSS scores: 10.0) &#8211; Unrestricted upload of file with dangerous type vulnerabilities that could lead to arbitrary code execution<\/li>\n<li><b>CVE-2026-48277, CVE-2026-48281, CVE-2026-48316<\/b> (CVSS scores: 10.0) &#8211; Improper input validation vulnerabilities that could lead to arbitrary code execution<\/li>\n<li><b>CVE-2026-48282<\/b> (CVSS score: 10.0) &#8211; A path traversal vulnerability that could lead to arbitrary code execution<\/li>\n<li><b>CVE-2026-48313<\/b> (CVSS score: 9.3) &#8211; A path traversal vulnerability that could lead to arbitrary file system read<\/li>\n<li><b>CVE-2026-48315<\/b> (CVSs score: 9.3) &#8211; An improper input validation vulnerability that could lead to privilege escalation<\/li>\n<\/ul>\n<p>The issues have been addressed in ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10. Security researchers Anirudh Anand, Matan Sandori, and 2Bsecure have been credited with discovering and reporting CVE-2026-48283, CVE-2026-48313, and CVE-2026-48307.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/sygnia-cyber-response-d-2\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhr7HGzx4ULDSqwnN820pPGxlPxqqVxKgIrI5II1iWdspOL6yHZsdB5lWoXU3LmhIU4dtnph89fLZ0CxrQSs-ufs6Mo4eD-d-Cpx-DsV1G15eC-phLACF7hyaKSIH1zIdj3AuD7lHSHnVelmKVMoVV-_zvtJuodsSIDKu6uSRfU6fZBkO-2PERqKSfIn6dA\/s728-e100\/sygnia-d-2.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Separately, Adobe has also <a href=\"https:\/\/helpx.adobe.com\/security\/products\/campaign\/apsb26-69.html\">shipped<\/a> fixes to close out a critical flaw in Adobe Campaign Classic impacting versions ACC v7: 7.4.3 build 9396 and earlier for Windows and Linux that could result in\u202farbitrary code execution.<\/p>\n<p>The vulnerability, tracked as <b>CVE-2026-48286<\/b> (CVSS score: 10.0), is a case of incorrect authorization that could enable an attacker to execute arbitrary code on affected systems. It has been patched in version ACC v7: 7.4.3 build 9397.<\/p>\n<p>Adobe noted that CVE-2026-48286 only impacts on-premise Adobe Campaign instances, including fully on-premise deployments and on-premise components in hybrid deployments. Adobe-hosted instances have already been updated and require no action.<\/p>\n<p>The company also emphasized that it has not found any exploits in the wild for any of the issues addressed as part of the two updates.<\/p>\n<p>The disclosure comes as Adobe said it&#8217;s moving from monthly to twice-monthly publication of security bulletins and advisories on the second and fourth Tuesday of each month starting July 14, 2026, as a direct result of accelerated vulnerability discovery using artificial intelligence (AI) models.<\/p>\n<p>\u00abThe frontier AI capabilities we are using are also available to attackers, and the window between public vulnerability disclosure and active exploitation is compressing from days to hours,\u00bb Adobe&#8217;s Chief Security Officer Aanchal Gupta <a href=\"https:\/\/blog.adobe.com\/security\/protecting-customers-faster-how-adobe-is-responding-to-ai-accelerated-vulnerability-discovery\">said<\/a>. \u00abWe are applying AI to find and fix vulnerabilities first, and getting those fixes to customers faster is the natural next step.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Jul 01, 2026Artificial Intelligence \/ Vulnerability Adobe has released patches for multiple maximum-severity security flaws impacting Adobe ColdFusion and Adobe Campaign Classic. The ColdFusion updates \u00abresolves critical and important&hellip;<\/p>\n","protected":false},"author":1,"featured_media":1556,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1135,6,2287,2286,497,11,57],"class_list":["post-1555","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-adobe","tag-campaign","tag-classic","tag-coldfusion","tag-cvss","tag-flaws","tag-patches"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1555","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1555"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1555\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1556"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}