Adobe Patches Three Critical CVSS 10.0 Vulnerabilities in ColdFusion and Campaign Classic

Adobe has shipped security updates to address multiple critical vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic platforms. According to the advisory, the most severe flaw, CVE-2026-48362, is an operating system command injection vulnerability in ColdFusion with a CVSS score of 10.0. Successful exploitation could allow an attacker to execute arbitrary code or escalate privileges on affected systems.

In addition to the command injection flaw, Adobe addressed privilege escalation vulnerabilities in the same release. The updates impact ColdFusion and Campaign Classic platforms. Adobe has not confirmed public exploitation of these vulnerabilities at the time of patching, though OS command injection flaws are typically considered high-risk for remote code execution.

Security updates were released on 2026-08-12. Users of ColdFusion and Campaign Classic are advised to apply the latest patches immediately to reduce the risk of exploitation.