Loading story…
Adobe released security updates for 12 products, fixing 88 vulnerabilities across its portfolio, with the most urgent issues affecting ColdFusion. The ColdFusion advisory was rated Priority 1 and addresses 13 flaws, including eight critical vulnerabilities that could allow arbitrary code execution or privilege escalation through path traversal, code injection, improper input validation, missing authentication, SQL injection, and incorrect authorization.
The fixes are included in ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22. Adobe also patched critical vulnerabilities in Commerce, Experience Manager, and Illustrator, and said it is not aware of any of the newly addressed vulnerabilities being exploited in the wild.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Adobe released security updates addressing 88 vulnerabilities across 12 products. The most urgent fixes were for ColdFusion, where Adobe patched 13 flaws including eight critical issues and said it was not aware of in-the-wild exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecyber.gc.ca
Open sourcesecurityweek.com
Open sourcehelpx.adobe.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe has released Priority 1 security updates for **ColdFusion** and **Adobe Campaign Classic** to fix multiple high-severity vulnerabilities, including seven flaws rated `CVSS 10.0`. In ColdFusion, the patched issues affect versions `2025.9`, `2023.20`, and earlier, and include improper input validation (`CVE-2026-48281`, `CVE-2026-48277`), unrestricted file upload (`CVE-2026-48276`, `CVE-2026-48283`), and path traversal (`CVE-2026-48282`) bugs that could allow unauthenticated remote code execution without user interaction. Additional ColdFusion flaws include a path traversal issue with arbitrary file read and limited write access (`CVE-2026-48313`), an SSRF bug (`CVE-2026-48285`), and user-interaction issues such as reflected XSS (`CVE-2026-48307`) and improper input validation tied to malicious files (`CVE-2026-48315`). Adobe also patched `CVE-2026-48286` in **Adobe Campaign Classic**, an incorrect authorization flaw affecting version `7.4.3` and earlier that can lead to arbitrary code execution on on-premises instances. Adobe said it is not aware of in-the-wild exploitation of the specific vulnerabilities, but assigned the updates a **Priority 1** rating, indicating they are being targeted or are at high risk of being targeted, and urged administrators to patch within 72 hours. Recommended versions include **ColdFusion 2025 Update 10**, **ColdFusion 2023 Update 21**, and **Campaign Classic 7.4.4 / build 9397 or later**.
Jul 12, 2026
Adobe has released security updates addressing several critical and high-severity vulnerabilities in ColdFusion versions 2025.4, 2023.16, 2021.22, and earlier. The vulnerabilities include improper input validation, improper access control, unrestricted upload of files with dangerous types, deserialization of untrusted data, and improper restriction of XML external entity references. These flaws could allow attackers to bypass security features, gain unauthorized read and write access, execute arbitrary code, escalate privileges, and read sensitive files from the server. Most of these vulnerabilities can be exploited remotely and do not require user interaction, with some specifically requiring high-privileged access. Adobe's security bulletin (APSB25-105) confirms that there are currently no known exploits in the wild for these issues. The company strongly recommends users update to the latest versions—ColdFusion 2025 Update 5, 2023 Update 17, and 2021 Update 23—to mitigate the risks. Additional guidance includes using the latest MySQL Java connector and reviewing updated serial filter documentation to protect against insecure deserialization attacks. Organizations using affected ColdFusion versions should prioritize patching to prevent potential exploitation of these vulnerabilities.
Jun 29, 2026
Adobe released a broad set of security advisories covering creative, enterprise, and e-commerce products, and the Canadian Centre for Cyber Security urged organizations to review and apply the updates. Affected software includes **ColdFusion**, **Adobe Experience Manager (AEM)**, **Adobe Commerce**, **Magento Open Source**, **Animate**, **After Effects**, **Audition**, **Bridge**, **Media Encoder**, **Premiere**, **Premiere Pro**, **Illustrator**, **Creative Cloud Desktop Application**, and Content Credentials tools and SDKs. Among the disclosed issues, **ColdFusion** flaws `CVE-2026-48363` and `CVE-2026-48364` are uncontrolled search path vulnerabilities that can lead to arbitrary code execution when a user opens a malicious file; **Animate** bugs `CVE-2026-48345` and `CVE-2026-48350` can also enable code execution via malicious files through OS command injection and path traversal; and **AEM** vulnerabilities `CVE-2026-48310` and `CVE-2026-48252` are more severe for internet-facing deployments because they require no user interaction and can allow arbitrary file reads, unauthorized write access, and security feature bypass. Adobe also issued fixes for multiple **Adobe Commerce**, **Adobe Commerce B2B**, **Magento Open Source**, and **Adobe Commerce Webhooks Plugin** vulnerabilities, including stored XSS, incorrect authorization, improper output encoding, and unrestricted file upload issues, with patched July 2026 releases and Webhooks Plugin version `1.21.0` identified as remediated versions.
Jul 15, 2026