Full Report
Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. The most severe of the flaws are listed below - CVE-2026-48362 (CVSS score: 10.0) - An operating system command injection vulnerability in ColdFusion that could
Analysis Summary
# Vulnerability: Multiple Critical Flaws in Adobe ColdFusion and Campaign Classic
## CVE Details
* **CVE ID:** CVE-2026-48362, CVE-2026-71398, CVE-2026-27302 (Primary CVSS 10.0 flaws)
* **CVSS Score:** 10.0 (Critical)
* **CWE:**
* OS Command Injection (CVE-2026-48362)
* Eval Injection (CVE-2026-48273)
* Incorrect Authorization (CVE-2026-71398, CVE-2026-27302, CVE-2026-71384, CVE-2026-71362)
* SQL Injection (CVE-2026-48381)
## Affected Systems
* **Products:**
* Adobe ColdFusion
* Adobe Campaign Classic (ACC)
* Adobe Commerce
* **Versions:**
* ColdFusion 2025 and 2023
* Adobe Campaign Classic v7
* **Configurations:**
* **Campaign Classic:** Specifically impacts fully on-premise deployments and on-premise components of hybrid deployments. (Adobe-hosted instances are already remediated).
## Vulnerability Description
Adobe released patches for several high-impact vulnerabilities. The most critical (CVE-2026-48362) is an **OS command injection** vulnerability in ColdFusion that allows an attacker to execute arbitrary commands on the host operating system. Other flaws include **eval injection**, which allows execution of arbitrary code within the application context, and several **incorrect authorization** flaws in Campaign Classic and Commerce that permit unauthorized arbitrary code execution or privilege escalation.
## Exploitation
* **Status:** Not currently exploited in the wild; no known public PoC.
* **Complexity:** Low (Based on Priority 1 rating).
* **Attack Vector:** Network.
## Impact
* **Confidentiality:** Critical (Full access to system data).
* **Integrity:** Critical (Ability to modify system files and code).
* **Availability:** Critical (Potential for total system takeover or Denial of Service).
## Remediation
### Patches
* **ColdFusion:** Update to versions **2025.0.12** or **2023.0.23**.
* **Campaign Classic:** Update to **ACC v7 7.4.4 build 9400**.
* **Adobe Commerce:** Apply updates specified in APSB26-92 (refer to vendor advisory).
### Workarounds
* There are no official workarounds listed. Administrators are advised to apply patches within **72 hours** due to the Priority 1 rating.
## Detection
* **Indicators of Compromise:** Monitor for unusual outbound network traffic from ColdFusion servers and unauthorized administrative log-ins or credential changes in Campaign Classic.
* **Detection methods:** Utilize web application firewalls (WAF) to inspect for command injection patterns (e.g., `;`, `&&`, `|`) and SQL injection strings in HTTP requests.
## References
* Adobe Security Advisory (ColdFusion): [https://helpx.adobe.com/security/products/coldfusion/apsb26-90.html]
* Adobe Security Advisory (Campaign Classic): [https://helpx.adobe.com/security/products/campaign/apsb26-123.html]
* Adobe Security Advisory (Commerce): [https://helpx.adobe.com/security/products/magento/apsb26-92.html]
* Adobe Security Severity Ratings: [https://helpx.adobe.com/security/severity-ratings.html]